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GAO 


United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


Comptroller  General 
of  the  United  States 


B-246064 


April  9,  1992 

The  Honorable  J.  J.  Pickle 
Chairman,  Subcommittee  on  Oversight 
Committee  on  Ways  and  Means 
House  of  Representatives 

The  Honorable  Pat  Williams 
Chairman,  Subcommittee  on 
Labor-Management  Relations 
Committee  on  Education  and  Labor 
House  of  Representatives 

In  response  to  your  Subcommittees’  requests,  we  are  providing  information  on  (1)  audits  of 
employee  benefit  plans  and  (2)  the  evidence  supporting  the  November  1989  study  by  the 
Department  of  Labor  Office  of  Inspector  General  that  criticized  these  audits.  In  this  report,  we 
identify  requirements  for  employee  benefit  plan  audits,  describe  the  results  of  our  review  of 
employee  benefit  plan  audits,  and  discuss  scope  limitations  in  these  audits.  We  also  identify  ways 
to  enhance  plan  reporting  and  audits. 

This  report  recommends  that  the  Congress  amend  the  Employee  Retirement  Income  Security 
Act  of  1974  to  require  full  scope  audits  of  employee  benefit  plans  and  to  require  plan 
administrators  and  independent  public  accountants  to  report  on  how  effective  an  employee 
benefit  plan’s  internal  controls  are  in  protecting  plan  assets.  These  internal  controls  should  be  a 
key  safeguard  in  protecting  the  interests  of  plan  participants  and  the  government  as  an  insurer 
of  some  plans. 

We  are  sending  copies  of  this  report  to  the  Chairmen  of  various  Congressional  Committees  and 
Subcommittees,  the  Secretary  of  Labor,  and  the  Chairman  of  the  American  Institute  of  Certified 
Public  Accountants.  Copies  will  be  available  to  others  on  request. 


This  report  was  prepared  under  the  direction  of  David  L.  Clark,  Director  of  Legislative  Reviews 
and  Audit  Oversight,  who  may  be  reached  on  (202)  275-9489  if  you  or  your  staffs  have  any 
questions.  Other  major  contributors  are  listed  in  appendix  IV. 


Executive  Summary 


Purpose 


In  November  1989,  the  Department  of  Labor’s  Office  of  Inspector  General 
(IG)  identified  significant  deficiencies  in  audits  of  private  employee  benefit 
plans.  These  findings  generated  congressional  concerns  about  the 
protection  of  American  workers’  benefits  and  the  risks  associated  with 
inadequate  plan  audits.  As  a  result,  the  chairmen  of  the  House 
Subcommittee  on  Oversight,  Committee  on  Ways  and  Means,  and  the 
House  Subcommittee  on  Labor-Management  Relations,  Committee  on 
Education  and  Labor,  asked  GAO  to  identify  problems  in  the  performance 
of  plan  audits.  In  so  doing,  GAO  also  identified  various  ways  to  improve 
plan  reporting  and  audits  and,  thus,  further  protect  the  interests  of  plan 
participants. 
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The  Employee  Retirement  Income  Security  Act  of  1974  (ERISA)  established 
various  safeguards  to  protect  the  assets  of  private  employee  benefit  plans 
and  to  ensure  that  plan  participants  receive  benefits  to  which  they  are 
entitled.  Under  ERISA,  the  Department  of  Labor  requires  that  an  employee 
benefit  plan  (plan)  having  100  or  more  participants  obtain  an  annual 
financial  statement  audit  by  an  independent  public  accountant.  Audits  of 
employee  benefit  plans  are  a  key  safeguard  for  protecting  much  of  about 
$1.75  trillion  in  assets  held  by  plans.  Also,  ERISA  established  the  Pension 
Benefit  Guarantee  Corporation  which  insures  about  95,000  defined  benefit 
pension  plans. 

ERISA  established  fiduciary  standards  for  plans  and  required  that  annual 
reports  on  plan  operations,  including  an  annual  audit,  be  furnished  to  the 
Department  of  Labor  and  made  available  to  plan  participants.  According  to 
Labor’s  Office  of  Inspector  General,  ERISA  cannot  be  materially  enforced 
without  plan  audits. 

In  November  1989,  the  Labor  IG  reported  that  64  of  279  plan  audits  it 
reviewed  violated  at  least  one  auditing  standard.  Labor  referred  14  of  these 
64  plan  audits  to  the  American  Institute  of  Certified  Public  Accountants 
(aicpa),  a  voluntary  professional  association  which  provides  guidance  on 
auditing,  for  investigation  of  serious  audit  deficiencies.  GAO  reviewed  25 
plan  audits  randomly  selected  from  the  remaining  50  in  order  to  assess  the 
reasonableness  of  the  iG’s  criticisms. 

In  the  last  several  years,  GAO  has  become  increasingly  concerned  about  the 
inadequacies  of  audits  which  do  not  specifically  address  an  entity’s  internal 
controls  and  compliance  with  applicable  laws  and  regulations.  Legislation 
enacted  at  the  end  of  1991  adopted  GAO  recommendations  to  require 
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reforms  to  deal  with  inadequacies  in  financial  statement  audits  of  insured 
depository  institutions,  thereby  helping  to  protect  the  government  in  its 
capacity  as  insurer  of  deposits  in  such  institutions. 


Results  in  Brief 


Over  a  third  of  the  25  plan  audits  reviewed  by  GAO  had  audit  weaknesses  so 
serious  that  their  rehability  and  usefulness  were  questionable.  In  some 
cases,  the  auditors  failed  to  adequately  test  investments  amounting  to 
millions  of  dollars  or  test  the  appropriateness  of  millions  of  dollars  in 
payments  to  insurance  companies.  These  deficiencies  indicate  that  auditors 
were  sometimes  unfamiliar  with  ERISA  requirements  and  the  special 
considerations  associated  with  auditing  employee  benefit  plans.  Although 
the  AICPA  revised  its  guidance  for  performing  plan  audits  in  1991, 
additional  changes  in  the  guide  are  needed. 

Further  action  is  needed  to  adequately  protect  the  interests  of  plan 
participants.  Legislation  should  be  enacted  to  eliminate  limited  scope 
audits,  which  are  presently  permitted  by  ERISA.  Legislation  should  also 
adopt,  with  appropriate  modifications,  the  model  reforms  recently  enacted 
for  federally  insured  depository  institutions.  The  legislation  should  require 
reporting  on  the  adequacy  of  internal  controls  by  plan  administrators  and 
auditors,  provide  for  direct  reporting  to  the  Department  of  Labor  of  fraud 
and  serious  erisa  violations,  and  require  peer  review  for  plan  auditors. 
These  changes  would  enhance  the  value  of  plan  audits,  encourage  better 
plan  management,  and,  ultimately,  better  protect  the  interests  of  plan 
participants  and  the  government. 


Principal  Findings 


Failures  by  Auditors  to  GAO  evaluated  25  of  the  plan  audits  previously  reviewed  by  the  IG  to 

Properly  Audit  determine  if  they  were  properly  performed  and  if  the  iG’s  criticisms  were 

reasonable.  GAO  foimd  that  nine  of  the  plan  audits  did  not  satisfactorily 
comply  with  auditing  standards  because  they  had  problems  that  were  so 
severe  that  their  reliability  and  usefulness  were  seriously  diminished.  The 
AICPA  identified  many  of  the  same  types  of  violations  during  its 
investigation  of  the  14  plan  audits  referred  by  Labor.  For  these  reasons, 
GAO  concluded  that  the  iG’s  findings  were  generally  reasonable. 

The  predominant  problems  in  the  plan  audits  were  insufficient  audit  work 
or  the  lack  of  working  paper  evidence  to  prove  that  audit  work  was 
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sufficient  to  support  the  unqualified  opinions  expressed  by  some  auditors. 
In  one  case,  for  example,  the  working  papers  showed  no  evidence  of  tests 
for  virtually  all  plan  disbursements  used  to  purchase  insurance  policies  for 
plan  participants.  Many  deficiencies  involved  the  specialized  auditing 
procedures  intended  to  provide  evidence  about  assets  held  by  plan 
trustees,  actuarial  valuations,  or  the  appropriateness  of  plan  participant 
benefits.  GAO  concluded  that  these  problems  demonstrated  that  some 
auditors  lacked  industry  knowledge  and  were  not  aware  of  erlsa 
requirements.  The  November  1989  IG  study  noted  a  similar  problem  of 
limited  understanding. 


Initiatives  Taken  to  Improve  in  response  to  the  ig  study,  the  aicpa  has  initiated  various  actions  to 

Audit  Quality  publicize  plan  audit  problems  and  better  educate  auditors  about  the  audit 

procedures  and  requirements  for  plan  audits.  The  AICPA  also  expanded  its 
guidance  on  conducting  plan  audits.  GAO  believes  that  these  initiatives  are 
important  steps  toward  ensuring  that  auditors  have  the  expertise  needed  to 
improve  the  usefulness  and  reliability  of  future  plan  audits.  However, 
additional  changes  need  to  be  made  to  the  audit  guide  to,  among  other 
things,  clarify  audit  requirements  and  emphasize  the  need  for  specialized 
industiy  knowledge. 


Reporting  and  Auditing 
Requirements  Under  ERISA 
Need  Strengthening 


GAO  believes  that  legislation  is  needed  to  strengthen  reporting  and  auditing 
requirements  for  plans  and  to  further  protect  the  interests  of  plan 
participants.  Legislation  should  include  several  provisions. 

First,  the  legislation  should  eliminate  the  limited  scope  audit  provision 
from  ERISA.  This  provision  allows  plan  administrators  to  exclude  from  the 
scope  of  the  audit  investments  held  by  certain  regulated  institutions,  such 
as  banks  and  insurance  companies.  Eliminating  the  limited  scope  provision 
from  ERISA  would  subject  all  plan  assets  to  audit  and  decrease 
vulnerabilities  associated  with  plan  assets.  GAO  found  that  over  25  percent 
of  the  total  $  126  million  in  plan  assets  covered  by  the  25  plan  audits  it 
reviewed  were  excluded  from  examination  under  ERISA’s  limited  scope 
provision. 


Second,  the  legislation  should  require  reports  on  the  effectiveness  of 
internal  controls  by  the  plan  administrator  and  the  auditor.  Plan 
administrators  have  a  fiduciary  responsibility  to  operate  plans  in  the  best 
interest  of  plan  participants.  Requiring  plan  administrators  to  prepare  and 
sign  reports  on  the  effectiveness  of  the  internal  control  structure,  including 
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controls  for  compliance  with  laws  and  regulations,  and  then  providing  the 
reports  to  regulators,  participants,  and  others,  would  help  ensure  that 
adequate  controls  are  established  and  maintained. 

Requiring  auditors  to  review  plan  administrators’  reports  on  internal 
controls  would  help  protect  plan  participants’  interests  by  helping  to 
ensure  that  plans  maintain  strong  internal  controls,  adhere  to  laws  and 
regulations,  and  properly  report  their  financial  condition.  Such  reviews 
could  also  provide  early  warnings  of  potential  problems.  Similarly,  reviews 
of  internal  control  reports  would  benefit  the  federal  government,  which,  as 
insurer  of  defined  benefit  pension  plans,  faces  a  significant  liabihty  if  plans 
Avith  large  unfunded  habilities  terminate. 

Further,  GAO  believes  that  auditors  have  a  basic  public  responsibility  and 
must  consider  the  government’s  interests  when  auditing  federally  insured 
employee  benefit  plans.  Auditors  should  be  required  to  play  a  more  active 
role  in  assisting  regulators  and  plan  administrators  in  identifying, 
preventing,  and  correcting  problems  in  financial  reporting  and  internal 
controls.  This  expansion  of  the  auditor’s  role  is  in  keeping  with  GAO’s  behef 
that  auditors  must  recognize  that  they  have  greater  responsibilities  when 
accepting  audit  engagements  for  federally  insured  entities.  Similar 
provisions,  which  are  important  reforms  in  auditing  and  reporting  for 
federally  insured  financial  institutions,  were  recently  enacted  in  the  Federal 
Deposit  Insurance  Corporation  Improvement  Act  of  1991  (Public  Law 
102-242). 

Third,  legislation  should  require  auditors  to  report  fraud  and  serious  ERISA 
violations  directly  to  the  Department  of  Labor.  While  both  plan 
participants  and  Labor  have  significant  interests  in  ERISA  violations,  there 
is  no  requirement  in  erisa  or  Labor’s  implementing  regulations  that  either 
be  promptly  and  directly  informed  by  the  auditor  when  fraud  or  serious 
fiduciary  breaches  are  discovered.  Such  a  provision  would  increase 
protection  of  plan  participants. 

Fourth,  legislation  should  require  all  audit  firms  which  audit  employee 
benefit  plans  to  obtain  a  peer  review.  Peer  review  programs  essentially 
entail  the  verification  by  other  audit  firms  that  the  firm  reviewed  has  a 
system  of  quaUty  controls  that  reasonably  ensures  that  audits  meet 
established  standards.  Requiring  all  audit  firms  which  audit  employee 
benefit  plans  to  participate  in  a  peer  review  program  that  includes  at  least 
one  plan  audit  would  help  ensure  that  audit  firms  performing  plan  audits 
adhere  to  auditing  standards  and  perform  quality  audits. 
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Recommendations 

GAO  makes  recommendations  to  the  Department  of  Labor,  the  AICPA,  and 
the  Congress  in  chapters  2,3,  and  4.  Of  particular  importance  are  the 
legislative  recommendations  that  the  Congress  amend  ERISA  to: 

(1)  eliminate  the  provision  that  permits  limited  scope  audits,  (2)  require 
reports  by  plan  administrators  and  auditors  on  internal  controls, 

(3)  reqnire  reporting  by  auditors  of  fraud  and  serious  ERISA  violations,  and 

(4)  require  peer  review  of  auditors  conducting  plan  audits. 

Agency  Comments 


Both  the  Secretary  of  Labor  and  the  Chairman  of  the  Board  of  the 
American  Institute  of  Certified  Public  Accountants  commented  on  a  draft 
of  this  report.  (See  appendixes  II  and  III.) 


Labor  agreed  with  many  of  GAO’s  recommendations  but  expressed 
concerns  with  the  recommendations  on  internal  control  reporting  and 
direct  reporting  to  Labor  of  serious  ERISA  violations.  However,  Labor  did 
agree  that  significant  internal  control  weaknesses  can  lead  to  fraud  and 
abuse  of  plan  assets.  Labor  stated  that  it  is  currently  assessing  alternative 
approaches  for  the  identification  and  reporting  of  significant  internal 
control  weaknesses.  With  respect  to  direct  reporting,  Labor  is  considering 
whether  plan  administrators  should  be  required  to  report  to  Labor 
information  related  to  certain  criminal  acts  involving  employee  benefit 
plans  covered  by  ERISA.  However,  this  does  not  utilize  the  resource  of  the 
independent  auditor  to  help  protect  against  criminal  acts  by  plan 
administrators. 


The  AICPA  stated  that  it  is  considering  many  of  GAO’s  recommendations.  It 
also  stated  that  it  supports  cost  beneficial  efforts  and  suggestions  to 
increase  the  protection  of  plan  participants  but  has  concern  about  creating 
unrealistic  expectations  relative  to  the  role  and  work  of  independent 
accountants.  GAO  believes  implementing  its  recommendations  would  allow 
the  profession  to  better  meet  the  public’s  existing  expectations.  The  AICPA 
expressed  serious  concerns  with  direct  reporting  of  fraud  and  serious 
ERISA  violations  to  Labor  because  of  its  view  of  client  confidentiality.  GAO 
disagrees  with  this  view  and  believes  the  auditor  should  be  required  to 
report  fraud  and  serious  ERISA  violations  when  the  plan  administrator  fails 
to  do  so. 
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Introduction 


In  1988,  the  latest  year  for  which  data  are  available,  an  estimated  5.2 
million  employee  benefit  plans  (plans)  covered  by  the  Employee 
Retirement  Income  Security  Act  of  1974  (ERISA)  had  assets  of  about  $  1 .75 
trillion.  These  plans  fell  into  three  general  categories. 

•  Approximately  146,000  were  defined  benefit  pension  plans  which  provide 
a  set  level  of  benefits  based  on  such  factors  as  years  of  employment,  age, 
and  compensation  received. 

•  Approximately  585,000  were  defined  contribution  pension  plans  which 
have  separate  accounts  for  each  participant.  Contributions  are  invested, 
and  benefits  are  based  on  the  amounts  in  each  participant’s  account. 

•  Approximately  4.5  million  were  health  and  welfare  plans  which  provide,  for 
example,  medical  and  dental  benefits  and  insurance  policies.  These 
benefits  are  paid  from  accumulated  contributions  and  income  or  through 
the  purchase  of  insurance  policies. 


ERISA  Safeguards 


ERISA  was  enacted  to  protect  plan  jissets  from  mismanagement,  fraud,  and 
abuse  and  to  ensure  that  plan  participants  receive  the  benefits  to  which 
they  are  entitled.  To  protect  plan  participants,  ERISA  established  fiduciary 
standards  for  plan  operations.  ERISA  defines  a  fiduciary  as  anyone  who 
exercises  any  discretionary  authority  or  control  over  management  or 
administration  of  a  plan  or  the  management  or  disposition  of  its  assets; 
gives  investment  advice  (for  compensation)  with  respect  to  any  property  of 
a  plan;  or  has  any  authority  or  responsibility  to  do  so.  ERISA  also 
established  the  Pension  Benefit  Guaranty  Corporation  (PBGC),  which 
guarantees  payment  of  most  private  sector  defined  benefit  pensions  if 
plans  become  unable  to  pay. ' 

Prior  to  enacting  ERISA,  the  Congress  found  that  the  interests  of  plan 
participants  were  not  adequately  protected,  among  other  reasons  because 
plan  participants  lacked  information  about  their  plans.  To  address  this 
problem,  ERISA  established  reporting  and  disclosure  requirements  for  plan 
administrators.  These  include  providing  plan  annual  reports  to  regulators 
and  making  these  annual  reports  available  to  participants. 

For  plans  having  100  or  more  participants,  the  annual  reports  ordinarily 
include  a  Form  5500,  financial  statements,  schedules  required  by  ERISA  or 


'ERISA  excluded  from  PBGC  insurance  coverage  some  defined  benefit  pension  plans,  such  as 
government  plans,  and  some  church  and  fraternal  organization  plans. 
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The  Role  of  Auditing 


1 


Labor  regulations  (ERISA  schedules),  and  a  report  of  an  independent  public 
accountant  with  respect  to  such  financial  statements  and  schedules.  A 
Form  5500  contains  general  information  on  a  plan’s  sponsor,  funding 
arrangements,  participants,  and  financial  operations.  The  ERISA  schedules 
disclose,  among  other  things,  information  on  investment  activities,  loans  or 
leases  in  default,  and  transactions  that  may  involve  conflicts  of  interest. 
Appendix  I  provides  details  on  reporting  and  disclosure  requirements 
under  ERISA. 

Under  ERISA,  Labor  requires  each  plan  having  100  or  more  participants  to 
obtain  an  annual  plan  audit,  which  must  be  conducted  by  an  independent, 
qualified  public  accountant,  generally  a  certified  pubhc  accountant  (CPA). 
To  meet  this  requirement,  an  administrator  of  such  a  plan  must  hire  an 
auditor,  on  behalf  of  all  plan  participants,  to  audit  and  report  on  plan 
financial  statements  and  ERISA  schedules.  The  plan  administrator  may 
exercise  ERISA’s  limited-scope  provision,  which  allows  the  plan 
administrator  to  exclude  plan  investments  held  by  certain  regulated 
institutions  such  as  banks  and  insurance  companies  from  the  scope  of  the 
audit. 

The  Department  of  Labor  is  primarily  responsible  for  enforcing  ERISA 
fiduciary  standards,  which  require  that  plans  be  operated  in  the 
participants’  best  interests.  In  this  regard.  Labor  conducts  investigations  to 
ensure  that  plan  administrators  comply  with  ERISA  fiduciary  standards  and 
that  plan  information  is  available  to  participants  and  other  interested 
parties.  The  Internal  Revenue  Service  (iRS)  is  responsible  for  administering 
and  enforcing  ERISA’s  vesting,  participation,  and  funding  requirements  and 
determining  whether  plans  qualify  for  favorable  tax  treatment  under  the 
Internal  Revenue  Code.  IRS  accomplishes  this  by  reviewing  plan  designs 
and  examining  pension  plan  returns  and  operations  for  compliance  with 
tax  laws  and  regulations. 


As  we  testified  in  July  1990,^  plan  audits  are  a  prime  means  of  ensuring 
that  plans  comply  with  ERISA  safeguards.  By  scrutinizing  and  reporting  on 
plan  transactions  and  operations,  such  audits  (1)  make  key  information 
available  to  plan  participants  so  they  can  monitor  their  own  plans  and 
(2)  provide  discipline  by  evaluating  whether  plan  administrators  have 
fulfilled  their  fiduciary  duties  and  comphed  with  laws  and  regulations. 


^Audits  of  Employee  Benefit  Plans  Need  to  Be  Strengthened  (GAO/r-AFMD-90-25,  July  24, 1990). 
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Plan  audits  also  can  help  regulators  ensure  that  plan  participants’  interests 
are  protected.  According  to  Labor,  annual  reports— including  audit 
reports— provided  by  plans,  are  its  most  valuable  source  of  information  for 
targeting  investigations  because  these  reports  may  contain  information 
indicative  of  erisa  violations.  According  to  Labor’s  Office  of  Inspector 
General  (IG),  Labor  investigates  less  than  1  percent  of  all  plans  because  of 
limited  staff,  and  ERISA  cannot  be  materially  enforced  without  these  plan 
audits. 


Labor  IG  Study 


In  November  1989,  the  Labor  IG  issued  a  study®  which  concluded  that  64  of 
279  randomly  selected  plan  audits  violated  at  least  one  generally  accepted 
auditing  standard.  The  IG  further  reported  that  inadequate  audit  opens  the 
door  for  fraud  and  abuse,  such  as  disbursements  to  ineligible  individuals  or 
excessive  administrative  costs. 

Labor  referred  14  of  the  279  plan  audits  in  the  iG’s  sample,  or  5  percent,  to 
the  American  Institute  of  Certified  Public  Accountants  (aicpa)  for  what  it 
termed  “egregious  disregard”  of  professional  standards.  In  response,  the 
AICPA  independently  investigated  these  14  plan  audits.  The  AICPA  also 
reviewed  the  working  papers  supporting  the  IG  study  to  (1)  analyze  the 
audit  deficiencies  noted  by  the  IG  and  (2)  identify  ways  to  reduce  their 
occurrence  in  the  future. 

The  IG’s  criticisms  prompted  congressional  concerns  about  whether  plan 
audits  provide  the  protections  intended  by  ERISA  and  raised  serious 
questions  regarding  the  security  of  about  $1.75  trillion  in  plan  assets. 
Similarly,  these  criticisms  raised  questions  about  PBGC’s  financial  future.  In 
fiscal  year  1990,  the  PBGC  insurance  funds  guaranteed  about  95,000 
defined  benefit  pension  plans  for  39  million  participants. 

In  January  1991,  we  stated  '  that  PBGC’s  financial  future  depends  on,  among 
other  things,  the  amount  of  future  liabilities  that  PBGC  may  incur  as  a  result 
of  weaknesses  in  plan  oversight,  including  limited  scope  audits.  To  the 
extent  that  plan  audits  provide  early  detection  and  reporting  on  plan 


"changes  Arc  Needed  in  the  ERISA  Audit  Process  to  Increase  Protections  for  Employee  Benefit  Plan 
Participants,  U.S.  Department  of  Labor,  Office  of  inspector  General,  09-90-00 1-12-001  (Washington, 
D.C.:  November  9,  1989). 

''Our  audit  opinion  is  contained  in  Pension  Benefit  Guaranty  Corporation  1990  Annual  Report,  Pension 
Benefit  Guaranty  Corporation  (W'ashington,  D.C.;  September  1990),  pp.  46-47. 
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problems,  these  audits  can  improve  plan  management  and  supervision  and 
ultimately  reduce  the  risk  of  claims  against  PBGC  insurance  programs. 


The  November  1989  IG  study  prompted  the  Chairman  of  the  House 
Subcommittee  on  Oversight,  Committee  on  Ways  and  Means,  and  the 
Chairman  of  the  House  Subcommittee  on  Labor-Management  Relations, 
Committee  on  Education  and  Labor,  to  ask  us  to  identify  problems  in  the 
performance  of  plan  audits.  The  objectives  of  our  review  were  to 

•  identify  requirements  for  plan  audits, 

•  identify  problems  in  the  performance  of  plan  audits, 

•  assess  the  reasonableness  of  the  iG’s  criticisms  of  plan  audits,  and 

•  evaluate  actions  taken  since  1989  to  improve  the  quality  of  plan  audits. 

We  also  identified  ways  to  enhance  plan  reporting  and  audits  and  thus 
strengthen  key  ERISA  safeguards. 

To  identify  the  requirements  for  plan  audits,  we  reviewed  requirements  for 
audits  contained  in  sections  103  and  104  of  ERISA  (29  U.S.C.  1023, 1024 
(1988))  and  Labor  regulations  (29  C.F.R.  part  2520  (1990)).  In  addition, 
we  reviewed  various  AICPA  publications,  including  theAlCPA  Codification  of 
Statements  on  Auditing  Standards  and  the  AICPA  Audit  and  Accoimting 
Guide  for  Employee  Benefit  Plans  (1983  edition,  1990  exposiure  draft,  and 
1991  edition). 

To  identify  problems  in  the  performance  of  plan  audits,  we  randomly 
selected  25  audits  from  among  50  of  the  64  plan  audits  the  IG  reported  as 
violating  at  least  one  auditing  standard.  We  excluded  from  our  selection 
the  14  plan  audits  that  Labor  had  referred  to  the  AICPA  for  review. 

However,  we  obtained  information  from  the  AICPA  on  the  results  of  its 
review  of  these  14  plan  audits  and  considered  its  findings  in  developing  our 
recommendations. 

The  25  plan  audits  selected  for  our  detailed  review  examined  assets  of 
$126  million  held  by  12  defined  contribution  pension  plans,  8  defined 
benefit  pension  plans,  and  5  health  and  welfare  plans.  A  total  of  21  audit 
firms  performed  these  audits  nationwide.  These  included  1 1  local  firms 
having  one  office,  6  national  firms,  and  4  regional  firms  with  multiple 
offices.  Four  of  these  21  audit  firms  each  performed  two  of  the  selected 
audits. 


Objectives,  Scope,  and 
Methodology 


Page  13 


GAO/AFMD-92-14  ERISA 


Chapter  1 
Introduction 


In  evaluating  these  plan  audits,  we  reviewed  audit  reports,  audit  programs, 
supporting  working  papers,  and  permanent  files.  We  also  used  a  standard 
data  collection  instrument  to  record  our  findings  and  discussed  the  audit 
work  with  appropriate  staff  at  each  of  the  21  audit  firms  involved. 

We  measured  the  quality  of  these  plan  audits  by  the  extent  of  their 
compliance  with  auditing  standards  and  ERISA  reporting  and  disclosure 
requirements  that  were  in  effect  when  they  were  performed.  In  so  doing, 
we  made  professional  judgments  about  the  nature  and  significance  of 
violations  of  auditing  standards  and  ERISA  reporting  requirements  and  their 
effects  on  each  audit  as  a  whole.  Then,  we  categorized  the  audits  as 
satisfactory  or  unsatisfactory.  In  our  judgment,  a  satisfactory  audit 
complied  with  all  pertinent  auditing  standards  and  ERISA  requirements  or 
included  only  technical  violations  that  did  not  affect  the  quality  of  the  audit 
as  a  whole.  An  unsatisfactory  audit  included  auditing  standards  violations 
which  were  so  severe  that  the  reliability  or  usefulness  of  the  audit  report 
was  seriously  diminished. 

To  assess  the  reasonableness  of  the  iG’s  findings,  we  reviewed  the  iG’s 
November  1989  report  entitled  Changes  Are  Needed  in  the  ERISA  Audit 
Process  to  Increase  Protections  for  Employee  Benefit  Plan  Participants;  its 
sampling  methodology;  and  review  guides  that  the  IG  used  in  evaluating 
plan  audits.  We  also  interviewed  IG  staff  and  reviewed  the  IG’s  working 
papers  for  each  selected  audit.  Based  on  our  own  assessment  of  the 
auditor’s  work,  we  made  professional  judgments  about  the  validity  of 
auditing  standards  violations  identified  by  the  IG. 

To  evaluate  actions  taken  since  1989  to  improve  the  quality  of  plan  audits, 
we  obtained  information  on  pertinent  legislation  proposed  by  Labor  and  on 
AICPA  actions. 

We  conducted  our  work  from  April  1990  through  August  1991  in 
accordance  with  generally  accepted  government  auditing  standards. 

We  obtained  written  comments  on  a  draft  of  this  report  from  the 
Department  of  Labor  and  the  American  Institute  of  Certified  Public 
Accountants.  Their  comments  are  included  in  their  entirety  in  appendixes 
II  and  III. 
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Nine  of  the  25  plan  audits  we  reviewed  had  auditing  standards  violations 
that  were  so  severe  that  the  reliability  or  usefulness  of  the  audit  reports 
was  seriously  diminished.  Many  of  the  deficiencies  we  identified  stemmed 
from  lack  of  auditor  knowledge  about  special  considerations  associated 
with  auditing  employee  benefit  plans.  The  November  1989  IG  study  and  the 
AICPA  investigation  of  14  plan  audits  referred  by  Labor  identified  similar 
problems. 


Insufficient  Evidence  of 
Audit  Work 


Insufficient  Planning  and 
Supervision 


Although  we  concluded  that  the  remaining  16  plan  audits  in  our  review 
generally  complied  with  auditing  standards,  we  found  that  most  included 
standards  violations  of  a  technical  nature,  which,  in  our  judgment,  did  not 
seriously  diminish  the  reliability  or  usefulness  of  the  audit  report. 


The  working  papers  for  eight  of  the  nine  plan  audits  having  serious 
problems  did  not  comply  with  auditing  standards  for  fieldwork  due  to 
problems  with  planning,  supervision,  or  retention  of  audit  evidence  in  the 
form  of  working  papers.  Many  of  the  specific  deficiencies  in  these  audits 
reflected  special  problems  associated  with  auditing  employee  benefit  plans. 

Auditing  standards  for  fieldwork  generally  encompass  the  planning  and 
performance  of  audits  as  well  as  the  sufficiency  and  competency  of 
evidential  matter  obtained  to  support  the  auditor’s  conclusions  and 
opinions.  These  standards  also  require  auditors  to  retain  a  written  record 
in  the  form  of  working  papers.  The  information  contained  in  working 
papers  constitutes  the  principal  record  of  an  auditor’s  work  and 
conclusions  reached  when  performing  an  audit. 


The  fieldwork  standard  for  planning  and  supervision  requires  that  audit 
work  be  adequately  planned  and  that  staff,  if  any,  be  properly  supervised. 
In  planning  an  audit,  auditors  should  prepare  a  written  audit  program  or 
set  of  programs  which  set  forth,  in  reasonable  detail,  the  audit  procedures 
necessary  to  accomplish  the  audit’s  objectives. 

The  working  papers  for  eight  of  the  nine  plan  audits  having  serious 
problems  showed  insufficient  evidence  of  planning.  The  working  papers  in 
four  cases  lacked  written  audit  programs,  and  the  audit  programs  for 
another  four  cases  omitted  such  elements  as  objectives,  reporting 
requirements,  or  a  description  of  planned  auditing  procedures  for  major 
audit  segments.  The  omitted  elements  pertained  to  matters  which  auditors 
should  consider  when  developing  an  overall  strategy  for  conducting  a  plan 
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audit.  For  example,  two  of  these  audit  programs  for  defined  benefit 
pension  plans  omitted  auditing  procedures  for  testing  the  reliability  of 
payroll,  demographic,  and  benefit  data  for  plan  participants.  This  type  of 
participant  data  is  critical  to  actuarial  valuations  of  contributions  and 
accumulated  plan  benefits  for  defined  benefit  pension  plans. 

The  fieldwork  standard  for  planning  and  supervision  also  requires  auditors 
to  review  the  work  performed  by  staff  to  determine  whether  it  was 
adequately  performed  and  to  evaluate  whether  the  results  are  consistent 
with  the  conclusions  in  the  audit  report.  The  working  papers  for  six  of  the 
nine  plan  audits  having  serious  problems  showed  insufficient  evidence  of 
supervision.  Three  cases  showed  no  evidence  of  supervisory  reviews,  and 
evidence  of  such  reviews  was  incomplete  in  another  three  cases. 

During  its  investigations  of  the  1 4  plan  audits  referred  by  Labor,  the  AICPA 
found  similar  problems  with  planning.  According  to  the  AICPA,  five  of  these 
plan  audits  lacked  written  audit  programs  and  another  three  included  audit 
programs  which  did  not  detail  the  auditing  procedures  necessary  to 
accomplish  the  audit’s  objectives. 


Inadequate  Evidence  of 
Testing 


The  fieldwork  standard  for  evidential  matter  requires  auditors  to  obtain 
sufficient  competent  evidential  matter  through  inspection,  observation, 
inquiries,  and  confirmations  to  afford  a  reasonable  basis  for  expressing  an 
opinion  regarding  the  financial  statements  under  examination.  The 
working  papers  for  eight  of  the  nine  plan  audits  having  serious  problems 
showed  insufficient  evidence  that  various  audit  segments  had  been 
performed.  Many  of  these  audit  segments  involved  special  considerations 
associated  with  auditing  employee  benefit  plans’  financial  statements. 
Given  this  insufficient  evidence,  six  of  these  eight  plan  audits  included 
inadequately  supported,  unqualified  opinions  on  the  plans’  financial 
statements. 


Insufficient  Evidence  of  Actuarial  The  reliability  of  actuarial  valuations  is  critical  in  defined  benefit  pension 
Valuation  Tests  plan  audits  because  auditors  use  such  valuations  to  substantiate  actuarial 

computations  of  required  contributions  and  accumulated  plan  benefits. 
Accumulated  plan  benefits  are  the  present  value  of  benefits  due  to 
participants  in  the  future.  The  fieldwork  standard  for  evidence  precludes 
auditors  from  simply  relying  on  actuarial  reports  for  these  amounts. 
Rather,  auditors  must  ascertain  that  the  actuary  has  the  necessary 
professional  qualifications  and  then  assess  the  reasonableness  of  the 
actuary’s  objectives,  methods,  and  assumptions.  Further,  auditors  must 


Page  16 


GAO/AFMD.92-14  ERISA 


Insufficient  Evidence  of 
Allocation  Tests 


Chapter  2 

Deficiencies  in  Audits  of  Employee  Benefit 
Plans 


test  the  reliability  and  completeness  of  participant  data  used  in  making 
actuarial  valuations.  Testing  the  adequacy  of  payroll,  demographic,  and 
benefit  data  which  are  provided  to  actuaries  is  critical  because  actuaries 
use  this  data  in  making  actuarial  valuations  of  contributions  and 
accumulated  plan  benefits.  Significant  errors  in  participant  data  provided 
to  actuaries  may  have  a  material  effect  on  the  amounts  of  contributions 
required.  For  example,  if  these  contributions  are  underestimated,  plans 
will  lack  the  assets  needed  to  fund  the  benefits  of  plan  participants. 

In  three  Ccises,  the  working  papers  for  audits  of  defined  benefit  pension 
plans  showed  little  or  no  evidence  that  the  work  of  actuaries  or  related 
participant  data  were  tested.  For  example,  in  one  case,  the  working  papers 
contained  no  evidence  supporting  the  appropriateness  of  the  $2.4  miUion 
in  accumulated  plan  benefits  shown  on  the  plan’s  financial  statements.  The 
actuary’s  report  included  in  the  working  papers  for  another  case  weis  dated 
after  the  date  of  the  auditor’s  report.  In  addition,  the  working  papers  for 
one  of  these  cases  showed  no  evidence  that  the  actuary’s  qualifications 
were  assessed. 

During  its  investigations  of  the  14  plan  audits  referred  by  Labor,  the  AICPA 
found  that  four  did  not  include  sufficient  evidence  of  testing  participant 
data. 


According  to  the  AICPA  audit  guide,  auditors  should  test  whether  plan 
earnings  and  employer  contributions  were  properly  allocated  to  the 
accounts  of  plan  participants  in  defined  contribution  pension  plans.  Such 
tests  are  important  since  these  allocated  amounts  represent  the 
accumulated  benefits  available  for  each  plan  participant. 

We  found  that  the  working  papers  for  three  audits  of  defined  contribution 
pension  plans  showed  no  evidence  that  allocations  of  contributions  to 
participant  accounts  were  tested.  In  one  case,  for  example,  no  allocations 
of  contributions  for  all  146  plan  participants  were  tested. 

In  two  of  the  three  cases,  the  working  papers  for  audits  of  defined 
contribution  plans  also  contained  insufficient  evidence  that  required  tests 
of  material  contributions  or  benefit  payments  had  been  performed.  In  one 
of  these  cases,  the  working  papers  contained  no  evidence  that  tests  were 
made  to  confirm  that  employer  contributions  totaling  about  $165,000 
equaled  the  amount  authorized.  Further,  the  working  papers  showed  no 
evidence  that  tests  were  done  to  ascertain  if  benefit  payments  of  about 
$88,000  made  by  the  plan’s  trustee  were  received  by  individuals  entitled  to 
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Insufficient  Evidence  of 
Insurance  Premium  Tests 


Insufficient  Evidence  of 
Discretionary  Trust  Tests 


them.  Such  tests  are  important  to  ensure  that  benefit  payments  were  not 
made  to  deceased  individuals  or  others  not  qualified  under  the  provisions 
of  a  plan. 


According  to  the  AICPA  audit  guide,  auditors  should  determine  if  premium 
amounts  sent  to  insurance  companies  by  health  and  welfare  plans  that 
provide  benefits  through  purchased  insurance  are  appropriate.  Premium 
amounts  are  generally  determined  from  participant  eligibility  records  and 
premium  rates  in  insurance  contracts. 

In  two  cases,  the  working  papers  for  audits  of  health  and  welfare  plans 
showed  no  evidence  that  the  responsible  auditors  obtained  insurance 
contracts  or  confirmed  premium  payments  to  test  the  appropriateness  of 
amounts  paid.  In  one  case,  these  payments  amounted  to  about  $2.3  million 
of  the  plan’s  $3.4  million  total  disbursements.  This  audit’s  working  papers 
also  showed  no  evidence  that  the  auditor  obtained  insurance  contracts  or 
confirmed  premium  amounts  to  test  about  $2.57  million  in  estimated 
liabilities  for  future  benefits  out  of  $2.60  million  in  total  plan  liabilities.  In 
the  other  case,  these  premium  payments  amounted  to  about  $4.6  million  of 
the  plan’s  $4.7  million  in  total  disbursements. 


Plan  investments  are  ordinarily  administered  separately  from  other  plan 
operations  because  fiduciaries  usually  engage  a  trustee,  investment 
advisor,  or  both  to  manage  such  investments.  According  to  the  AlCPA  audit 
guide,  auditors  should  be  aware  that,  in  planning  auditing  procedures,  they 
need  to  consider  the  nature  of  trustee  arrangements  as  well  as  the  physical 
location  of  and  control  over  plan  records  and  investments. 

Discretionary  trustee  arrangements  authorize  trustees  to  purchase  and  sell 
investments  within  the  framework  of  trust  instruments.  As  a  result,  plan 
administrators  often  do  not  have  their  own  records  of  transactions 
executed  by  these  trustees  and  must  rely  on  information  provided  by  the 
trustee.  According  to  the  AICPA  audit  guide,  auditors  performing  an  audit 
involving  a  discretionary  trust  should  obtain  evidence  about  the  adequacy 
of  the  trustees’  internal  control  structure.  To  do  so,  the  guide  suggests  that 
auditors  obtain  a  special  purpose  report  on  a  trustee’s  internal  controls. 
This  report,  which  is  sometimes  referred  to  as  a  single-audit  report,  is 
prepared  by  an  auditor  engaged  by  the  discretionary  trustee.  If  a 
single-audit  report  cannot  be  obtained,  the  AICPA  audit  guide  suggests  that 
the  auditor  evaluate  the  discretionary  trustee’s  internal  controls. 
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In  two  cases,  discretionary  trustees  controlled  investments  which  were 
material  to  plan  financial  statements.  The  working  papers  for  both  audits, 
however,  showed  no  e\idence  that  the  responsible  auditors  obtained 
single-audit  reports  or  evaluated  discretionary  trustees’  internal  controls. 
Yet  in  both  cases,  the  auditors  inappropriately  expressed  inadequately 
supported  unqualified  opinions.  Investments  controlled  by  these  trustees 
amounted  to  virtually  all  of  these  plans’  aissets. 


Insufficient  Evidence  of  Testing  erisa  prohibits  transactions  involving  conflicts  of  interest  and  requires 

Transactions  Involving  Parties  in  disclosure  of  transactions  with  parties  in  interest.  The  fieldwork  standard 
Interest  for  evidence  requires  auditors  to  obtain  representation  letters  from  the 

audit  client  and  the  client’s  attorney.  According  to  the  AICPA  audit  guide, 
letters  obtained  from  the  client  should  cover  undisclosed  transactions 
involving  parties  in  interest.  Letters  obtained  from  the  client’s  attorney  also 
may  include  statements  regarding  such  transactions  and  should  describe 
and  evaluate  pending  or  threatened  litigation,  claims,  and  assessments 
involving  the  attorney.  The  AICPA  audit  guide  suggests  other  auditing 
procedures  to  identify  prohibited  transactions.  For  example,  the  guide 
suggests  that  the  auditor  obtain  a  list  of  parties  in  interest  to  help 
determine  if  transactions  involving  them  have  occurred. 

In  three  cases,  the  working  papers  for  plan  audits  did  not  contain  client 
representation  letters,  and,  in  two  of  these  cases,  the  working  papers  also 
did  not  contain  representation  letters  from  the  clients’  attorneys.  In 
addition,  the  three  CEises’  working  papers  showed  little  or  no  evidence  that 
auditing  procedures  suggested  by  the  AICPA  audit  guide  were  performed  to 
identify  transactions  involving  parties  in  interest. 

During  its  investigations  of  the  14  plan  audits  referred  by  Labor,  the  AICPA 
found  that  five  failed  to  obtain  (1)  sufficient  evidence  of  testing  for 
party-in-interest  transactions  and  (2)  representation  letters  from  the  client, 
the  client’s  attorney,  or  both. 


Inadequate  Reporting 


The  audit  reports  for  five  of  the  nine  plan  audits  having  serious  problems 
did  not  comply  with  the  auditing  standards  for  reporting  because  these 
reports  did  not  address  inadequate  financial  statement  disclosures. 
Auditing  standards  for  reporting  require  auditors  to  take  exception  to 
financial  statements  that  do  not  adequately  disclose  material  matters. 
These  matters  relate  to  the  form,  arrangement,  and  content  of  the  financial 
statements  and  their  footnotes.  If  the  financial  statements  omit  such 
disclosures,  including  required  footnotes,  an  auditor  should  express  a 
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qualified  or  adverse  opinion  and  describe  the  omitted  matters  in  the  audit 
report. 

In  four  cases,  we  found  that  auditors  expressed  unqualified  opinions  on 
plan  financial  statements  that  did  not  disclose  material  matters,  and  the 
audit  reports  for  these  cases  did  not  describe  the  material  matters  omitted. 
In  one  case,  the  plan  financial  statements  were  materially  misstated 
because  they  omitted  all  information  about  one  of  the  plan’s  two  trusts. 

The  net  assets  of  the  omitted  trust  amounted  to  about  $510,000,  or  13 
percent,  of  the  plan’s  total  net  assets.  In  two  other  cases,  the  financial 
statements  of  defined  benefit  pension  plans  did  not  disclose  accumulated 
plan  benefits.  The  AlCPA  audit  guide  specifically  cites  this  type  of  omission 
as  cause  for  a  qualified  or  adverse  opinion.  The  fourth  case  had  a  number 
of  problems  including  financial  statements  that  did  not  disclose  the 
year-to-year  changes  in  the  actuarial  present  value  of  accumulated  plan 
benefits. 

In  the  fifth  case,  involving  a  disclaimer  of  opinion,  a  plan  reported 
information  on  a  Form  5500  on  its  net  assets  and  changes  in  net  assets 
available  for  plan  benefits  but  did  not  provide  all  the  footnotes  required  by 
ERISA.  Instead  of  reporting  this  fact  as  required  by  Labor  regulations,  the 
audit  firm’s  report  stated  that  the  information  presented  on  the  Form  5500 
complied  with  Labor  rules  and  regulations.  This  statement  was  incorrect. 

During  its  investigations  of  the  1 4  plan  audits  referred  by  Labor,  the  AlCPA 
found  that  five  of  these  audit  reports  failed  to  identify  and  describe  omitted 
footnotes  or  material  matters. 


Problems  Identified  by 
the  IG  Were  Generally 
Valid 


Overall,  we  believe  that  the  IG  study’s  criticisms  of  plan  audits  for  violating 
auditing  standards  were  reasonable.  Generally,  our  review  of  25  plan  audits 
identified  problems  similar  to  those  identified  by  the  IG  in  its  November 
1989  study.  The  IG  study  reported  problems  such  as  a  lack  of  audit 
programs,  insufficient  testing  or  documentation,  and  problems  with 
opinions  on  ERISA  schedules. 


In  reviewing  the  iG’s  work,  we  also  noted  that  the  IG  selected  its  279 
sample  plan  audits  from  less  than  half  of  the  approximately  55,000  plans 
Avith  100  or  more  participants  subject  to  the  audit  requirement  that  filed 
1986  annual  reports.  According  to  IG  representatives,  selecting  a  timely 
sample  from  all  of  the  plans  filing  for  1986  would  have  been  difficult 
because  of  late  filings.  They  explained  that  delaying  their  selection  to 
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include  most  late  filers  would  have  resulted  in  their  sampUng  plan  audits 
that  were  3  years  old. 

We  did  not  always  concur  with  the  iG’s  criticisms  of  individual  plan  audits. 
In  five  of  the  26  audits  we  reviewed,  we  did  not  agree  with  any  of  the 
specific  violations  identified  by  the  IG.  However,  in  all  five  of  these  cases, 
we  foimd  other  auditing  standards  violations  not  identified  by  the  IG  study. 
These  disagreements  generally  reflected  differing  professional  judgments 
about  sufficiency  of  evidence,  reporting,  due  professional  care  (which 
requires  that  an  auditor  be  conscientious  in  the  conduct  of  the 
engagement),  or  a  combination  of  these  factors. 


AICPA  Investigations 
Upheld  Most  of  Labor’s 
Findings 


The  AICPA,  as  the  national  professional  association  of  over  300,000 
certified  public  accoimtants,  plays  a  key  role  in  assuring  the  quality  of 
audits.  Although  the  AICPA  can  bring  CPAs  before  its  trial  board  and 
recommend  expulsion  from  its  membership,  its  enforcement  process 
usually  emphasizes  remedial  actions. 


The  AICPA  Professional  Ethics  Division  independently  investigated  all  14 
plan  audits  referred  by  Labor.  It  found  various  problems  in  10  of  the  14 
plan  audits  which,  as  discussed  earlier,  included  lack  of  audit  programs, 
insufficient  evidence,  and  inappropriate  opinions.  Following  its 
investigations,  the  Professional  Ethics  Division  took  varying  disciplinary 
actions  against  the  auditors  who  conducted  the  10  problem  audits.  The 
other  four  were  closed  with  a  finding  of  no  violation. 


Auditors  Lacked 
Required  Knowledge 


Based  on  discussions  with  auditors  and  reviews  of  their  working  papers, 
we  concluded  that  many  of  the  problems  with  plan  audits  reflected  a  lack 
of  knowledge  by  auditors  about  specialized  procedmes  needed  for  auditing 
employee  benefit  plans.  Table  2.1  summarizes  problems  that  we  identified 
that  are  associated  with  special  auditing  procedures  and  considerations  for 
plan  audits. 
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Table  2.1 :  Auditing  Standards  Violations 
Related  to  Special  Procedures  or 
Considerations  for  Plan  Audits 


Auditing  standards  violation 

Special  procedure  or  consideration 

Insufficient  evidence 

Tests  of  participant  data 

Tests  of  actuaries’  work 

Tests  of  allocations  of  employer  contributions 
to  participant  accounts 

Tests  of  insurance  premium  amounts 

Reviews  of  single-audit  reports  or  tests  of 
internal  controls  for  discretionary  trustees 

Inappropriate  unqualified  opinion 

Consideration  of  the  adequacy  of  financial 
statement  disclosures  about  accumulated 
plan  benefits 

The  responses  of  individual  auditors  we  talked  with  illustrate  this  lack  of 
industry  knowledge.  Wlten  asked  why  participant  data  were  not  tested  for  a 
defined  benefit  pension  plan,  one  auditor  did  not  know  what  the  applicable 
participant  data  elements  were.  Another  auditor  responded  that  he 
obtained  the  source  and  support  for  about  $2.4  million  in  accumulated 
plan  benefits  over  the  telephone  from  the  plan’s  actuary.  As  previously 
discussed,  auditing  standards  preclude  auditors  from  simply  accepting 
actuaries’  calculations  at  face  value.  Instead,  auditors  should  obtain 
evidence  of  actuaries’  methods,  assumptions,  and  participant  data  as  well 
as  their  professional  qualifications.  Further,  auditors  should  obtain  a  copy 
of  the  actuarial  report.  This  additional  evidence  allows  auditors  to  evaluate 
the  reasonableness  of  the  actuary’s  work, 


Auditors  Lacked 
Awareness  of  ERISA 
Reporting  and 
Disclosure 
Requirements 


We  also  found  that  auditors’  awareness  of  ERISA  reporting  and  disclosure 
requirements  was  often  limited.  In  addition  to  specifying  detailed  reporting 
requirements,  ERISA  authorizes  the  Secretary  of  Labor  to  prescribe 
simplified  and  alternative  methods  of  compliance  as  the  Secretary 
determines  appropriate.  By  regulation,  the  Secretary  has  prescribed  such 
methods.  Therefore,  in  preparing  the  annual  ERISA  report,  plan 
administrators  may  follow  the  requirements  delineated  by  ERISA  (statutory 
method)  or  by  Labor  regulations  (regulatory  method).  Auditors  performing 
10  of  the  25  plan  audits  in  our  review  said  they  did  not  know  whether  the 
financial  statements  they  examined  followed  the  statutory  or  regulatory 
method  of  reporting.  Such  knowledge  is  essential  because  these  two 
methods  have  different  requirements  for  reporting  elements,  such  as  the 
accounting  principles  used  to  prepare  financial  statements,  financial 
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statement  footnotes,  and  ERISA  schedules.  Appendix  I  provides  details  on 
the  statutory  and  regulatory  methods  of  reporting. 

Financial  statements  for  7  of  the  26  plan  audits  did  not  include  all  required 
footnotes,  and  18  omitted  ERISA  schedules.  In  seven  cases,  the  auditors 
performing  these  plan  audits  said  they  were  unaware  of  the  requirements 
for  the  omitted  erisa  schedules.  In  two  other  cases,  the  auditors  offered 
interpretations  of  exemption  provisions  as  the  reason  for  omitting  the 
required  schedules.  In  both  ceises,  the  auditors  misinterpreted  the 
regulations.  For  example,  these  auditors  inappropriately  excluded  from  the 
schedule  of  reportable  transactions  all  transactions  involving  debt 
obligations  of  the  United  States.  Such  transactions  are  exempt  from  the 
schedule  of  reportable  transactions  only  in  some  instances. 

The  IG  study  and  the  AlCPA’s  review  of  this  study  also  found  that  auditors 
lacked  a  full  understanding  of  ERISA  reporting  and  disclosure  requirements. 
One  finding  in  the  IG  study  was  that  181  of  the  279  plan  audit  reports 
reviewed  did  not  disclose  that  the  financial  statements  or  schedules  lacked 
at  least  one  ERISA-required  disclosure.  For  example,  the  IG  study  cited  84  of 
the  181  plans  that  did  not  comply  with  the  requirement  to  include  a 
schedule  of  assets  held  for  investment.  In  analyzing  the  findings  and 
recommendations  presented  in  the  IG  study,  the  AICPA  staff  identified  two 
primary  causes  for  plan  audit  problems:  auditors’  lack  of  understanding  of 
ERISA  requirements  for  plan  audits  and  their  failure  to  follow  guidance  in 
the  AICPA  audit  guide. 


Conclusions 


Overall,  the  iG’s  criticism  of  employee  benefit  plan  audits  was  reasonable. 
Our  review  and  the  investigation  by  the  AICPA  of  cases  referred  to  its 
Professional  Ethics  Division  found  many  problems  similar  to  those 
reported  by  the  IG.  Nine  of  the  audits  in  our  review  contained  standards 
violations  that  were  so  severe  that  the  reliability  and  usefulness  of  audit 
reports  was  seriously  diminished.  In  addition,  failures  by  auditors  to 
comply  with  auditing  standards  raise  questions  about  the  credibility  of  plan 
financial  information  reported  to  plan  participants  and  regulators.  Credible 
financial  information  is  essential  to  protect  the  interests  of  plan 
participants  and  the  government  as  an  insurer  of  some  plans. 

Our  findings  and  those  of  the  AICPA  also  paralleled  the  iG’s  findings 
regarding  auditors’  lack  of  knowledge.  Our  review  showed  that  some 
auditors  were  not  fully  aware  of  ERISA’s  reporting  and  disclosure 
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requirements.  The  IG  and  the  AICPA  reached  similar  conclusions  regarding 
the  causes  for  inadequacies  in  plan  audits. 


Recommendations 


Because  of  the  severity  of  the  violations  identified  in  nine  audits,  we 
recommend  that  the  Department  of  Labor  reconsider  the  nine  audits  and 
refer  the  auditors  to  professional  and/or  licensing  authorities  if  deemed 
appropriate. 


Agency  Comments  and 
Our  Response 


Comments  From  the  in  commenting  on  a  draft  of  this  report,  officials  from  the  Department  of 

Department  of  Labor  Labor  proposed  an  alternative  approach  to  our  recommendation  on 

referral  of  the  nine  audits  with  severe  violations.  Because  of  the  age  of  the 
audits  and  the  current  backlog  of  referrals.  Labor  proposed  reviewing 
more  recent  audit  reports  prepared  by  the  firms  in  question.  We  agree  with 
Labor’s  plan  to  look  at  more  recent  work.  However,  in  looking  at  more 
recent  work,  we  believe  that  Labor  should  review  supporting  working 
papers  as  well  as  audit  reports. 


Comments  FFom  the  AICPA  The  AICPA  stated  that  it  takes  allegations  concerning  poor  performance  by 

independent  accountants  extremely  seriously  and  agreed  to  review  and 
investigate  the  nine  audits  if  Labor  determines  that  such  action  would  be 
cost-effective. 

The  AICPA  also  stated  that  audit  deficiencies,  if  and  when  they  occur,  do  not 
necessarily  correlate  with  plan  mismanagement  or  beneficiary  risk.  It 
stated  that  the  risk  is  overwhelmingly  influenced  by  factors  beyond  the 
scope  of  audits  of  financial  statements  or  the  influence  of  independent 
accountants.  The  most  prominent  of  these  factors  is  the  quality  of 
investment  judgments  by  plan  administrators  or  investment  fiduciaries. 

We  agree  that  the  quality  of  investment  judgments  is  a  major  risk  affecting 
plans.  However,  credible  information  about  these  investment  judgments 
and  the  internal  controls  over  them  is  critical  in  assessing  how  well  plan 
administrators  and  investment  advisors  have  exercised  their  fiduciary 
responsibilities.  Audit  deficiencies  involving  incomplete  disclosure  of  plan 
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investments  or  inadequate  testing  of  investments  can  seriously  diminish 
the  usefulness  and  credibility  of  investment  information  available  to  plan 
participants  and  regulators.  Consequently,  we  believe  that  audit  failures 
can  significantly  increase  risk  to  plan  participants. 
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In  response  to  the  November  1989  IG  study,  the  AICPA  acted  to  improve  the 
quality  of  future  audits.  For  example,  it  has  publicized  problems  with  the 
performance  of  employee  benefit  plan  audits  and  has  expanded  audit 
guidance  on  how  to  conduct  these  audits.  Wliile  these  initiatives  are  helpful 
in  educating  the  audit  community,  we  identified  additional  actions  that  the 
AICPA  could  take  to  address  the  deficiencies  identified  in  our  review  and 
further  strengthen  the  guidance  provided  to  auditors. 


Publicizing  Problems 
With  Performing  Plan 
Audits 


To  address  audit  firms’  lack  of  understanding  of  ERISA  requirements,  the 
AICPA  widely  publicized  the  IG  study’s  results  and  findings.  Various  AICPA 
publications  reported  on  the  iG’s  criticisms  of  audits,  includingThe  CPA 
Letter  and  the  April  1990  Journal  of  Accountancy,  which  featured  a 
seven-page  article  discussing  the  iG’s  study.  The  CPA  Letter  is  a  news  report 
published  for  the  AICPA  membership.  The  monthly  Journal  of  Accountancy, 
with  a  circulation  of  over  300,000  to  AICPA  members  and  other  subscribers, 
includes  information  on  such  topics  as  accounting,  auditing,  tax,  and  legal 
issues. 


The  AICPA  made  its  membership  aware  of  the  results  of  the  IG  study.  Under 
AICPA  policy,  however,  the  results  of  its  investigations  of  the  1 4  plan  audits 
mentioned  earlier  will  not  be  published  unless  the  results  are  presented  to 
the  AICPA  trial  board  and  the  trial  board  finds  one  or  more  members  guilty 
of  violating  the  Code  of  Professional  Conduct.  The  AICPA  Professional 
Ethics  Division  referred  3  of  these  14  plan  audits  to  the  trial  board.  Of  the 
three  cases,  one  trial  board  hearing  has  been  held  and  the  auditor  was 
found  guilty.  A  second  case  was  scheduled  to  be  heard  in  January  1992. 
The  third  referral  was  contingent  on  whether  the  auditor  continued  to 
practice.  That  auditor  has  elected  to  retire  and  surrender  his  CPA  license. 

According  to  AICpa  representatives,  it  considers  its  investigations  of 
individual  audit  firms  highly  sensitive,  and  the  results  are  confidentially 
provided  only  to  those  investigated.  As  a  result,  other  members  are  not 
routinely  apprised  of  the  aicpa’s  findings  regarding  specific  audit 
deficiencies  or  of  related  disciplinary  actions. 
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Expanding  Guidance 
on  Conducting  Plan 
Audits 


The  AICPA  has  issued  a  number  of  publications  to  improve  the  quality  of 
future  plan  audits,  including  audit  risk  alerts  and  a  specialized  checkhst.  It 
also  sponsored  a  national  training  conference. 

Most  importantly,  the  AICPA  revised  its  guide  for  auditing  employee  benefit 
plans  in  March  1991  to  include  the  many  changes  in  auditing  and 
accounting  standards  that  had  occurred  since  1983,  when  the  guide  was 
originally  published.  For  example,  new  auditing  standards  require  that 
audit  firms  design  their  audits  to  provide  reasonable  assurance  of  detecting 
material  errors,  irregularities,  and  illegal  acts  and  that  they  communicate 
irregularities,  illegal  acts,  and  significant  control  weaknesses  to  their 
clients. 

In  addition,  the  revised  audit  guide  expanded  information  on  statutory 
provisions  and  regulations  applicable  to  audits  of  employee  benefit  plans. 
For  example,  the  revised  guide  includes  a  five-page  chapter  devoted 
exclusively  to  party-in-interest  transactions  that  the  1983  guide  covered  in 
less  than  one  page.  The  revised  chapter  expands  both  explanatory 
information  about  party-in-interest  transactions  and  suggests  auditing 
procedures  for  identifying  these  transactions.  However,  as  discussed  in 
chapter  4,  problems  with  the  basic  accounting  and  auditing  standards  for 
related  party  transactions  exist.  The  industry  guide  cannot  deal  with  these 
problems  until  the  basic  standards  are  improved. 

Further,  the  revised  guide  includes  a  33-page  appendix  describing  ERISA 
and  related  regulations.  According  to  the  AICPA,  this  appendix,  which  was 
prepared  with  Labor’s  assistance,  will  make  it  easier  for  audit  firms  to 
familiarize  themselves  with  important  ERISA  provisions.  The  AICPA  is 
currently  publishing  audit  guides  in  loose-leaf  form,  which  should  facilitate 
prompt  updates  on  relevant  emerging  issues. 

The  AICPA  informs  audit  firms  of  important  developments  related  to  ERISA 
and  AICPA  requirements  through  periodic  updates  to  the  AICPA  audit  guide. 
In  1990  and  1991,  the  AICPA  published  Employee  Benefit  Plans  Industry 
Developments  to  give  audit  firms  an  overview  of  matters  that  may  affect 
plan  audits,  including  recent  economic,  professional,  and  regulatoiy 
developments.  These  publications  also  incorporated  audit  risk  alerts 
which,  based  on  current  information  and  trends,  describe  factors  that  may 
be  especially  significant  in  plan  audits.  For  example,  failing  to  disclose 
known  violations  of  ERISA  regulations  in  audit  reports  was  among  the 
highlighted  risks.  The  alerts  are  for  firms  to  use  in  planning  their  audits. 
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To  further  assist  auditors  in  auditing  defined  benefit  pension  plans,  the 
AICPA  published  its  Checklist  for  Defined  Benefit  Pension  Plans  and 
Illustrative  Financial  Statements  in  April  1990.  This  checklist  provides  a 
number  of  brief  questions  or  statements  which  serve  as  memory  aids  for 
preparing  financial  statements  and  audit  reports.  The  checklist  covers 
financial  statements,  financial  statement  footnotes,  ERISA  reporting 
requirements,  and  audit  reports.  Further,  it  provides  illustrative  audit 
reports  and  financial  statements  for  defined  benefit  pension  plans. 

In  December  1990,  the  AICPA  sponsored  a  national  training  conference, 
with  Labor’s  participation,  on  auditing  employee  benefit  plans.  The 
conference  focused  on  (1)  current  issues  affecting  plans  and  plan  audits, 
(2)  various  ERISA  requirements,  and  (3)  the  iG’s  criticisms  of  plan  audits. 
Another  such  conference  was  held  in  December  1991. 

We  recognize  that  the  AICPA  has  taken  important  steps  to  monitor 
developments  in  the  environment  in  which  plans  operate  and  to  provide 
audit  guidance  more  promptly.  We  consider  the  AICPA  decisions  to  issue 
the  revised  audit  guide  quickly  and  to  publish  audit  guides  in  loose-leaf 
form  to  be  responsive  steps  which  can  improve  the  quality  of  plan  audits. 

However,  a  number  of  problems  identified  in  our  review  of  plan  audits  are 
not  adequately  dealt  with  in  the  revised  audit  guide.  They  include  the 
following: 

•  Although  audit  firms  are  engaged  by  plan  administrators  to  perform  plan 
audits  on  behalf  of  all  plan  participants,  the  guide  does  not  discuss  the 
importance  of  audits  in  protecting  plan  participants.  Since  these  audits  are 
a  key  safeguard  for  protecting  the  assets  which  underwrite  the  benefits  of 
plan  participants,  we  believe  that  it  is  critical  that  audit  firms  keep  the 
protection  of  plan  participants  in  mind  when  auditing  these  plans. 

•  The  revised  guide  does  not  discuss  the  importance  of  industry  knowledge 
in  auditing  employee  benefit  plans. 

•  The  revised  guide  does  not  clearly  explain  the  requirements  for  schedules, 
financial  statement  footnotes,  and  related  generally  accepted  accounting 
principles  (GAAP)  requirements. 
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Conclusions 


In  response  to  the  iG’s  criticisms  of  audits,  the  AICPA  promptly  initiated 
appropriate  steps  to  improve  future  audits.  These  included  revising  its 
audit  guide,  publicizing  the  results  of  the  IG  study,  and  alerting  audit  firms 
to  the  requirements  of  ERISA. 

Still,  a  number  of  the  specific  problems  identified  in  our  review  are  not 
adequately  addressed  in  the  revised  guide.  Greater  clarification  of  audit 
requirements  would  improve  audits  and,  thus,  further  protect  the  interests 
of  plan  participants  and  the  government.  Reporting  the  AlCPA’s 
investigation  results  to  its  membership  would  increase  the  profession’s 
awareness  of  the  consequences  of  poor  auditing  and  the  problems  that 
should  be  avoided  in  plan  audits.  We  believe  that  communicating  the 
details  of  problems  with  these  audits  without  identifying  specific  firms  will 
maintain  the  confidential  nature  of  these  investigations  while  fostering  an 
increased  awareness  of  the  types  of  problems  that  must  be  avoided. 


Recommendations 


To  further  strengthen  audits  of  employee  benefit  plans,  we  recommend 
that  the  AICPA  change  its  audit  guide  to 

discuss  the  importance  of  audits  in  protecting  plan  participants; 
discuss  the  need  for  auditors  to  have  specialized  industry  knowledge 
needed  to  successfully  perform  plan  audits;  and 
identify  and  clearly  describe  requirements  for  specific  schedules  and 
financial  statement  footnotes.  These  requirements  should  include  those  for 
statements  prepared  under  the  statutory  and  regulatory  methods,  as  well 
as  GAAP  requirements. 

We  also  recommend  that  the  AICPA  communicate  to  its  membership  the 
results  of  (1)  its  investigations  of  the  10  audits  referred  by  Labor,  with 
which  the  aicpa  found  problems  and  (2)  future  investigations  of  deficient 
plan  audits. 
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Agency  Comments  and 
Our  Response 


Comments  From  the  in  commenting  on  our  recommendation  to  the  AICPA  that  it  make  changes 

Department  of  Labor  to  audit  guide,  Labor  stated  that  it  believes  the  guide  already  contains 

the  necessary  basic  guidance  for  auditing.  We  continue  to  believe  that 
improvements  should  be  made  to  the  audit  guide  to  add  information  about 
the  importance  of  audits  in  protecting  plan  participants  and  to  discuss  the 
need  for  auditors  to  have  specialized  industry  knowledge.  We  also  continue 
to  believe  that  information  on  required  schedules  and  footnotes  should  be 
clarified. 

Labor  agreed  with  our  recommendation  on  communicating  results  of 
investigations  and  stated  that  Labor  has  urged  the  AICPA  to  publicize  the 
results  of  its  investigation  of  employee  benefit  plan  audits  referred  by 
Labor. 


Comments  From  the  AICPA  The  AICPA  responded  that,  in  its  audit  guide,  it  will  expand  information  on 

the  importance  of  audits  in  protecting  plan  participants.  It  also  will 
consider  expanding  the  audit  guide  to  (1)  discuss  the  need  for  specialized 
industry  knowledge  to  audit  plans  successfully  and  (2)  identify  and  clearly 
describe  schedule  and  footnote  requirements. 

The  AICPA  agreed  to  consider  publishing  the  results  of  future  investigations 
of  plan  audits  by  the  AICPA  Professional  Ethics  Division.  The  ajcpa  pointed 
out  that  the  nature  and  extent  of  its  ethics  investigations  were  discussed  at 
its  Employee  Benefit  Plans  Conference  in  December  1991  and  that  this 
information  wall  also  be  covered  in  a  future  article  in  theJournal  of 
Accountancy,  the  aicpa’s  monthly  publication. 
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Employee  benefit  plan  administrators  are  responsible  for  establishing 
sound  internal  controls  and  for  complying  with  ERISA  and  related  Labor 
regulations.  However,  neither  plan  administrators  nor  plan  auditors  are 
required  to  report  on  internal  controls,  including  those  established  to 
ensure  compliance  with  laws  and  regulations.  Also,  ERISA  allows  plan 
administrators  to  exclude  from  the  scope  of  the  plan  audit  (limited  scope 
audit)  plan  assets  held  by  certain  regulated  institutions,  such  as  banks  and 
insurance  companies.  As  a  result,  the  limited  scope  plan  audits  we 
reviewed  provided  little  or  no  assurance  about  the  existence,  ownership,  or 
value  of  plan  investments  involving  millions  of  dollars.  The  significance  of 
the  assets  may  result  in  auditors’  issuing  disclaimers  of  opinion,  which  may 
confuse  financial  statement  users.  We  believe  that  removing  ERISA’s  limited 
scope  provision  and  expanding  current  ERISA  requirements  to  address  the 
internal  control  issue  and  other  conditions  could  substantially  improve 
plan  management  and  enhance  the  usefulness  and  reliability  of  plan  audits. 
In  addition,  the  broader  issues  affecting  accounting  and  auditing  standards 
and  accountability  that  we  have  recommended  in  past  reports  are  relevant 
to  employee  benefit  plans. 


ERISA’s  Limited  Scope 
Provision  Diminishes 
Value  of  Audits 


Currently,  ERISA  allows  plan  administrators  to  exclude  plan  investments 
held  by  certain  regulated  institutions,  such  as  banks  and  insurance 
companies,  from  the  scope  of  a  plan  audit.  Because  these  assets  may  be  a 
significant  segment  of  plan  assets,  this  type  of  scope  hmitation  may  result 
in  auditors  disclaiming  an  opinion  on  the  plan’s  financial  statements.  This 
diminishes  the  value  of  the  audit  and  may  confuse  statement  users.  Also, 
there  is  no  reason  to  believe  that  these  assets  are  not  vulnerable  and  do  not 
need  audit. 


Ten  plan  audits  in  our  review  were  limited  scope  audits  and  thus  did  not 
include  examination  of  any  of  their  combined  $34  million  in  total  plan 
assets.  The  $34  million  in  plan  assets  not  examined  represented  over  a 
quarter  of  the  $  126  million  in  plan  assets  held  by  all  26  plans  we  reviewed. 

Auditing  plan  assets,  which  secure  the  benefits  for  plan  participants,  is  an 
essential  auditor  responsibility.  In  spite  of  the  importance  of  this 
responsibility,  auditors  may  largely  ignore  it  when  performing  a  limited 
scope  plan  audit,  which  typically  provides  only  minimal  assurances  about 
the  existence,  ownership,  and  value  of  a  plan’s  sissets  held  in  trust.  In  a  full 
scope  audit,  the  plan  auditor  must  gain  sufficient  support  for  transactions 
executed  by  the  trustee.  If  the  trustee  has  engaged  an  independent  auditor 
to  prepare  a  special  purpose  report  on  the  trust  department’s  internal 
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controls  (sometimes  referred  to  as  a  single  auditor  report),  the  plan 
auditor  should  obtain  and  read  a  copy  of  the  latest  available  report  for  use 
in  determining  the  scope  of  his  or  her  audit  procedures,  if  any.  Ordinarily  it 
should  not  be  necessary  for  the  plan  auditor  to  review  the  trust  department 
auditor’s  single-audit  working  papers,  provided  the  plan  auditor  is  satisfied 
with  the  professional  reputation  and  independence  of  the  trust  department 
auditor. 


Limited  Scope  Audits  Cause  if  the  audit’s  scope  is  not  sufficient  to  allow  the  auditor  to  form  an  opinion. 

Confusion  Among  Report  auditing  standards  require  auditors  to  express  a  disclaimer  of  opinion. 

Users  which  states  that  the  auditor  does  not  express  an  opinion  on  the  financial 

statements.  The  aicpa’s  suggested  language  for  a  disclaimer  of  opinion 
resulting  from  ERISA’s  limited  scope  provision  follows: 

“Because  of  the  significance  of  the  information  that  we  did  not  audit,  we 
are  unable  to,  and  do  not,  express  an  opinion  on  the  accompanying 
financial  statements  and  schedules  taken  as  a  whole.  The  form  and  content 
of  the  information  included  in  the  financial  statements  and  schedules,  other 
than  that  derived  from  the  information  certified  by  the  trustee,  have  been 
examined  by  us  and,  in  our  opinion,  are  presented  in  compliance  with  the 
Department  of  Labor  Rules  and  Regulations  for  Reporting  and  Disclosure 
under  the  Employee  Retirement  Income  Security  Act  of  1974.” 

We  believe  that  audit  report  users  can  interpret  this  suggested  language  in 
tw^o  ways.  On  one  hand,  the  opinion  initially  suggests  that  no  assurance  can 
be  provided  regarding  financial  statement  amounts  not  excluded  under  the 
ERISA  limited  scope  pro\ision  when  it  says  “.  .  .  we  are  unable  to,  and  do 
not,  express  an  opinion  on  the  accompanying  financial  statements  and 
schedules  taken  as  a  whole  .  . . .”  On  the  other  hand,  the  opinion 
subsequently  suggests  that  some  assurance  is  being  provided  for  the 
financial  statement  amounts  when  it  says  that  the  form  and  content  of 
information  included  in  statements  and  schedules  “. . .  in  our  opinion,  are 
presented  in  compliance  with  the  Department  of  Labor  Rules  and 
Regulations  .  ...”  As  a  result  of  these  confusing  statements,  users  of 
limited  scope  audit  reports  are  likely  to  be  uncertain  about  what,  if  any, 
assurance  these  reports  pro\ide. 

Audit  standards  require  auditors  who  perform  these  limited  scope  audits  to 
complete  all  other  audit  procedures  normally  done  on  a  full  scope  audit 
except  those  related  to  the  excluded  assets.  In  our  review,  we  found  that 
auditors  generally  performed  sufficient  work  to  support  their  opinions  that 
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plan  financial  statements  were  presented  in  compliance  with  Labor  rules 
and  regulations.  However,  the  IG  study  reported  that  some  auditors  in  the 
study  sample  performed  very  little  audit  work  in  any  area  of  plan 
operations  when  they  knew  they  would  issue  a  disclaimer  of  opinion 
because  of  erisa’s  limited  scope  provision.  The  IG  study  cited  one  case 
where  the  auditor  did  not  test  contributions,  benefit  payments,  or  other 
areas  because  he  planned  to  issue  a  disclaimer  of  opinion.  According  to  the 
IG  study,  this  auditor  said  that  he  believed  the  lack  of  testing  had  no  further 
effect  on  his  disclaimer  of  opinion. 


Actions  to  Require  Full  Scope  We  believe  that  a  disclaimer  of  opinion  as  a  result  of  the  ERISA  limited 
Audits  scope  provision  severely  limits  the  usefulness  of  a  plan  audit  to  regulators, 

plan  participants,  and  others.  According  to  the  AICPA,  plan  participants 
cannot  be  provided  the  full  assurance  intended  by  ERISA  if  the  audit 
excludes  certain  zissets.  The  November  1989  IG  study  advocates 
eliminating  ERISA’s  limited  scope  provision  for  the  same  reasons. 

A  Senate  bill  (S.  269, 102nd  Cong.)  introduced  in  January  1991  proposes 
eliminating  the  ERISA  limited  scope  provision.  The  bill’s  sponsors  have 
stated  that  without  thorough  and  comprehensive  audits,  the  assurances 
intended  by  ERISA  for  pension  beneficiaries  will  not  be  achieved.  The 
sponsors  have  further  stated  that  taxpayers  have  an  interest  in  maintaining 
tight  regulation  and  requiring  full  disclosure  for  industries  and  enterprises 
covered  by  federal  pension  insurance. 


Reporting  on  Internal 
Controls  Would 
Enhance  Audit 
Usefulness 


Internal  controls  are  the  policies  and  procedures  established  by 
management  to  provide  reasonable  assurance  that  specific  plan  objectives 
will  be  achieved.  Internal  control  objectives  include  assuring  reliability  of 
financial  records,  compliance  with  laws  and  regulations,  and  safeguarding 
assets.  Currently,  neither  ERISA  nor  its  implementing  regulations  require 
either  plan  administrators  or  auditors  to  report  on  the  effectiveness  of  a 
plan’s  internal  controls. 

We  believe  that  annual  reporting  on  internal  controls  by  plan 
administrators,  subject  to  auditor  review  and  attestation,  would  be 
appropriate  and  useful.  Plan  administrators  have  a  fiduciary  responsibility 
to  operate  plans  in  the  best  interest  of  plan  participants.  Requiring  plan 
administrators  to  prepare  and  sign  reports  on  the  effectiveness  of  the 
internal  control  structure,  including  controls  for  compliance  with  laws  and 
regulations,  and  then  providing  the  reports  to  regulators,  participants,  and 
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others  would  help  ensure  that  adequate  controls  are  maintained.  Requiring 
auditors  to  review  and  report  on  plan  administrators’  reports  on  internal 
controls  would  help  protect  the  plan  participants’  interests  by  helping  to 
ensure  that  plans  maintain  strong  internal  controls,  adhere  to  laws  and 
regulations,  and  properly  report  their  financial  condition.  Such  reviews 
could  also  provide  early  warnings  of  potential  problems.  Similarly,  reviews 
of  internal  control  reports  would  benefit  the  federal  government,  which,  as 
insurer  of  defined  benefit  pension  plans,  faces  a  significant  liability  if  plans 
with  large  unfunded  liabilities  terminate. 

Further,  we  also  believe  that  auditors  have  a  basic  responsibility  to  protect 
the  interests  of  participants  and  the  government  when  auditing  federally 
insured  employee  benefit  plans.  Auditors  should  take  an  active  role  in 
assisting  regulators  and  plan  administrators  in  identifying,  preventing,  and 
correcting  problems  in  financial  reporting  and  internal  controls.  This 
expansion  of  the  auditor’s  role  is  in  keeping  with  our  belief  that  audit  firms 
should  assume  greater  responsibility  when  accepting  audit  engagements 
for  federally  insured  entities.  We  have  also  taken  this  position  on  audits  of 
other  federally  insured  entities,  such  as  savings  and  loan  institutions  and 
banks. 

We  have  previously  recommended*  that  reports  on  internal  controls  (1) 
describe  management’s  responsibility  and  actions  taken  by  it  for 
establishing  and  maintaining  an  effective  internal  control  structure  and  for 
preparing  financial  statements,  (2)  contain  management’s  assessment  of 
the  effectiveness  of  the  internal  control  structure,  (3)  report  material 
weaknesses  that  have  not  been  corrected,  and  (4)  contain  the  signature  of 
the  appropriate  officer.  We  believe  that  reporting  such  information  with 
respect  to  employee  benefit  plans  subject  to  ERISA  would  also  be 
appropriate.  Congress  recently  included  similar  requirements  for  federally 
insured  financial  institutions  in  the  Federal  Deposit  Insurance  Corporation 
Improvement  Act  of  1991  (Public  Law  102-242). 


ERISA  Violations  Not 
Directly  Reported  to 
Labor 


While  both  plan  participants  and  Labor  have  significant  interests  in  ERISA 
violations,  there  is  no  requirement  in  ERISA  or  Labor’s  implementing 
regulations  that  either  be  promptly  and  directly  informed  by  the  auditor 
when  fraud  or  serious  fiduciary  breaches  are  discovered.  Rather,  plan 
administrators  are  required  to  report  certain  violations,  such  as  prohibited 
party-in-interest  transactions,  through  the  annual  reporting  process. 


*  Failed  Banks:  Accounting  and  Auditing  Reforms  Urgently  Needed  (GAO/AFMD-91-43,  April  22, 1991). 
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The  IG  study  took  the  position  that  there  is  a  basic  flaw  in  any  system  which 
asks  individuals  to  report  their  own  violations.  We  agree.  The  study  also 
discussed  significant  problems  with  Labor’s  procedures  for  reviewing  plan 
annual  reports.  First,  the  sheer  volume  of  annual  reports  prevents 
enforcement  staff  from  reviewing  each  report  for  erisa  violations.  Second, 
the  IG  study  explained  that  plan  annual  reports  normally  take  about  2  years 
to  reach  enforcement  staff.  The  study  attributed  this  to  (1)  Labor 
regulations  which  allow  210  days  from  the  end  of  a  plan’s  fiscal  year  to  file 
annual  reports  and  (2)  the  time  needed  to  process  these  reports  at  IRS  and 
Labor.  As  a  result,  the  IG  study  concluded  that  even  if  audit  reports  disclose 
violations,  there  are  no  assurances  that  those  disclosures  would  come  to 
Labor’s  attention  promptly. 

Like  ERISA,  auditing  standards  do  not  require  that  auditors  report  serious 
ERISA  violations  directly  to  Labor,  even  when  they  are  not  reported  by  a 
plan  administrator.  These  standards  do,  however,  require  auditors  to 
report  errors,  irregularities,  and  illegal  acts  detected  during  an  audit.  They 
are  to  be  reported  to  a  party  that  is  above  the  level  of  the  party  involved  in 
the  illegal  activity,  such  as  an  audit  committee  or  board  of  trustees.  In  the 
case  of  employee  benefit  plans,  for  a  single  employee  plan  that  does  not 
have  an  audit  committee,  the  party  with  the  level  of  authority  and 
responsibility  equivalent  to  an  audit  committee  would  normally  be  the 
named  fiduciary.  The  named  fiduciary  is  often  the  plan  sponsor,  an  officer 
thereof,  or  the  sponsor’s  board  of  directors.  For  a  multiemployer  plan, 
authority  and  responsibility  equivalent  to  that  of  an  audit  committee  would 
ordinarily  rest  with  the  board  of  trustees. 

Further,  auditing  standards  require  an  auditor  to  express  a  qualified 
opinion,  adverse  opinion,  or  disclaimer  of  opinion,  depending  on  the 
circumstances,  if  an  error,  irregularity,  or  illegal  act  has  a  material  effect 
on  the  financial  statements.  Also,  in  cases  involving  illegal  acts,  even  those 
that  are  immaterial,  the  auditor  may  conclude  that  if  the  client  does  not 
take  the  remedial  action  considered  necessary,  the  auditor  should 
withdraw  from  the  engagement.  Although  Labor  instituted  a  requirement  in 
filing  year  1988  to  report  termination  of  accountants  (Schedule  C  to  the 
Form  5500),  including  a  description  of  any  disagreement,  this  new  report 
is  triggered  only  if  the  auditor  is  terminated. 

Traditionally,  auditing  standards  have  recognized  the  existence  of  a  special 
auditor-client  relationship,  with  the  auditor’s  primary  responsibility  being 
to  the  client.  Accordingly,  any  outside  reporting  has  generally  been 
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Peer  Review  Valuable 
in  Assuring  Audit 
Quality 


considered  the  client’s  responsibility.  In  the  context  of  plan  audits, 
however,  viewpoints  differ  on  auditor-client  relationships. 

Current  auditing  literature  does  not  require  auditors  to  directly  report  to 
Labor  because  such  reporting  should  be  performed  by  plan  administrators. 
This  viev^TJoint  generally  reflects  the  traditional  view  that  plan 
administrators  are  the  clients. 

However,  the  IG  study  points  out  that  plan  participants  have  significant 
interests  in  ERISA  violations  and  plan  participants  are  actually  the  client 
because  ERISA  specifies  that  auditors  perform  audits  for  them.  The  IG  study 
further  expresses  the  view  that  plan  participants  or  a  party  acting  as  their 
agent  should  be  informed  of  erisa  violations.  The  study  explained  that 
Labor  is  fully  empowered  by  the  Congress  to  act  on  behalf  of  plan 
participants  and  should  receive  information  that  identifies  potential  threats 
to  plan  participant  benefits. 


Currently,  neither  ERISA  nor  its  implementing  regulations  requires  audit 
firms  to  participate  in  peer  review  programs.  Peer  review  programs 
essentially  entail  the  verification  by  other  audit  firms  that  the  firm  reviewed 
has  a  system  of  quality  controls  that  reasonably  ensures  that  audits  meet 
established  standards.  Audit  firms  performing  12  of  the  25  plan  audits  in 
our  review  had  not  participated  in  a  peer  review  program.  Further,  seven 
of  the  nine  audit  firms  performing  the  audits  that  did  not  satisfactorily 
comply  with  auditing  standards  had  not  participated  in  a  peer  review 
program.  Similarly,  the  AlCPA’s  analysis  of  the  IG  study  findings  indicated 
that  audit  firms  which  had  been  subject  to  a  peer  review  had  significantly 
fewer  auditing  standards  deficiencies  than  audit  firms  which  had  not 
received  a  peer  review. 

Various  AICPA  committees  set  standards  for  the  conduct  of  peer  reviews  by 
audit  firms,  associations,  and  state  societies.  One  of  two  methods,  systems 
oriented  or  engagement  oriented,  is  used  to  evaluate  the  quality  of  an  audit 
firm’s  work.  Generally,  large  audit  firms  with  more  than  20  professional 
staff  are  subject  to  systems-oriented  reviews  that  incorporate  detailed  tests 
of  a  firm’s  quality  control  system  and  a  review  of  selected  individual  audits. 
Engagement-oriented  reviews  which  stress  testing  and  evaluation  of 
individual  audits  are  an  option  for  smaller  firms  with  fewer  than  20 
professional  employees. 
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AICPA  standards  require  that  the  engagements  selected  for  review  provide  a 
reasonable  cross  section  of  the  reviewed  firm’s  accounting  and  auditing 
practice  and  that  greater  weight  be  given  to  audit  engagements  with  high 
risk  and  significant  public  interest.  In  this  regard,  the  AICPA  recently  issued 
guidance  on  one  peer  review  program  advising  reviewers  to  give  greater 
weight  to  plan  audits  when  samphng  audits  for  review.  For  two  other  peer 
review  programs,  the  AICPA  already  requires  the  examination  of  at  least  one 
plan  audit  as  part  of  each  peer  review.  These  actions  should  increase  the 
Ukelihood  of  plan  audits  being  included  in  peer  reviews  and,  thereby, 
improve  the  quality  of  these  audits  in  the  future. 

As  part  of  the  peer  review  process,  a  reviewer  issues  an  opinion  on  the 
audit  firm’s  compliance  with  AICPA  quality  control  standards.  The 
reviewer’s  findings,  comments,  and  recommendations,  and  any  AICPA 
information  on  sanctions  imposed  are  generally  available  to  the  public. 
AICPA  sanctions  usually  consist  of  required  revisits  by  peer  reviewers  and 
submission  of  continued  professional  education  records  over  a  given 
period. 

Currently,  participation  in  a  peer  review  program  is  mandatory  for  AICPA 
members  in  public  practice.  However,  not  all  audit  firms  performing  plan 
audits  are  AICPA  members,  and  thus  not  all  audit  firms  are  required  to 
participate  in  such  programs. 

A  Senate  bill  (S.  3267,  101st  Cong.)  introduced  in  October  1990,  would 
have  amended  ERISA  to  require  peer  reviews  for  all  audit  firms  performing 
plan  audits.  Labor  suggested  that  this  requirement  would  serve  the 
interests  of  participants,  beneficiaries,  and  the  government.  Although  the 
legislation  was  not  enacted  before  the  end  of  the  Congress,  we  beheve 
requiring  audit  firms  to  obtain  a  peer  review  which  includes  review  of  at 
least  one  plan  audit  would  strengthen  the  peer  review  process  as  a  control 
over  the  quality  of  plan  audits.  Labor  has  initiated  another  legislative 
package  currently  being  considered  by  the  administration  and  is 
considering  this  and  other  areas  cis  a  part  of  that  proposed  legislation. 


Audit  Reports  Not 
Addressed  to  Plan 
Participants 


Currently,  neither  ERISA  nor  its  implementing  regulations  require  that  plan 
audit  reports  be  addressed  to  participants  even  though  auditors  are 
engaged  on  their  behalf.  Of  the  25  plan  audit  reports  in  our  review,  for 
example,  only  two  were  addressed  to  plan  participants.  We  beheve  that 
audit  reports  addressed  jointly  to  plan  administrators  and  plan  participants 
will  more  closely  reflect  the  underlying  nature  of  these  engagements  and 
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the  accountability  auditors  have  to  both  parties.  Including  plan  participants 
as  audit  report  addressees  can  also  heighten  auditors’  awareness  of  their 
integral  role  in  protecting  plan  participants’  interests.  This  would  parallel 
the  current  practices  of  Securities  and  Exchange  Commission  registrants’ 
auditors,  who  generally  address  audit  reports  to  both  the  shareholders  and 
the  board  of  directors. 


Many  of  the  reforms  discussed  in  this  chapter  are  similar  to  reforms 
enacted  or  proposed  for  other  industries  and  areas.  For  example,  recent 
legislation-  adopted  many  of  our  recommendations  to  require  reforms  to 
deal  with  inadequacies  in  financial  statement  audits  of  insured  depository 
institutions,  thereby  helping  to  protect  the  government  in  its  capacity  as 
insurer  of  deposits  in  such  institutions.  Similar  reforms  for  employee 
benefit  plans  would  bring  about  increased  protections  for  plan 
participants. 

In  the  future,  we  will  continue  to  evaluate  such  reforms,  not  only  those 
recently  enacted  for  insured  depository  institutions,  but  those  enacted  or 
proposed  for  employee  benefit  plans,  federal  departments  and  agencies, 
state  and  local  governments,  the  insurance  industry,  and  securities 
registrants.  Recently  we  recommended^  that  applicable  accounting  rules 
and  auditing  standards  be  revised  to  ensure  that  related  party  transactions 
are  accounted  for  based  on  economic  substance  when  the  substance  of 
transactions  is  materially  different  from  the  legal  form.  Also,  we  stressed 
the  need  for  the  Congress  to  legislate  a  core  set  of  requirements  to 
strengthen  the  present  rules  concerning  internal  controls  for  all  public 
companies  registered  with  the  Securities  and  Exchange  Commission, 
including  requirements  to  increase  reporting  on  internal  controls  by 
management  and  auditors,  and  direct  reporting  by  auditors  of 
irregularities. 


Strengthened 
Requirements 
Consistent  Mdth 
Reforms  in  Other  Areas 


^The  Federal  Deposit  Insurance  Corporation  Improvement  Act  of  1991  (Public  Law  102-242). 

^Failed  Banks:  Accounting  and  Auditing  Reforms  Urgently  Needed  (GAO/AFMD-91-43,  April  22,  1991). 
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Conclusions 


Expanding  ERISA’s  audit  requirements  will  enhance  the  rehability  of  future 
plan  audits  and  thus  their  usefulness  in  protecting  the  interests  of  plan 
participants  and  the  government. 

Limited  scope  audits  currently  allowed  imder  ERISA  provide  inadequate 
assurance  that  plan  assets  are  being  safeguarded  when  auditors  disclaim 
opinions  on  plan  financial  statements  because  these  assets  are  material. 
There  is  no  reason  to  believe  that  those  excluded  assets  are  not  vulnerable 
and  do  not  need  audit.  Also,  disclaimers  of  opinion  cause  confusion  as  to 
the  extent  of  assurance  for  other  financial  statement  amounts.  We  believe 
that  a  disclaimer  of  opinion  limits  the  usefulness  of  audits  for  plan 
participants,  plan  administrators,  regulators,  and  others. 

A  plan  administrator’s  report  on  the  effectiveness  of  plan  internal  controls 
along  with  an  auditor’s  assessment  of  the  plan  administrator’s  assertions 
would  provide  some  assurance  to  plan  participants  that  the  plan  is 
maintaining  an  effective  control  system.  In  addition,  the  report  would 
emphasize  plan  administrators’  responsibihty  for  safeguarding  plan  assets 
and  complying  with  laws  and  regulations. 

We  also  beheve  the  interests  of  plan  participants  and  the  government 
would  be  better  served  by  auditors  promptly  reporting  serious  erisa 
violations  directly  to  Labor  if  plan  administrators  fail  to  do  so.  This  would 
require  reporting  such  violations  significantly  sooner  than  under  the 
current  annual  reporting  process.  While  there  is  no  current  requirement 
for  auditors  to  report  such  matters  directly  to  regulators,  we  agree  with  the 
IG  study  that  Labor  and  plan  participants  have  significant  Interests  in  ERISA 
violations. 

Peer  review  is  the  cornerstone  of  the  accounting  profession’s  quality 
assurance  efforts.  However,  not  all  audit  firms  participate  in  peer  review, 
and  those  that  do  participate  may  not  have  a  plan  audit  included  in  the 
audits  reviewed.  Requiring  all  audit  firms  which  audit  employee  benefits 
plans  to  participate  in  a  peer  review  program  that  includes  at  least  one  plan 
audit  would  help  ensure  that  audit  firms  performing  plan  audits  adhere  to 
auditing  standards  and  perform  quality  audits. 

Auditors  currently  are  not  required  to  address  audit  reports  to  plan 
participants  even  though  they  are  engaged  to  perform  plan  audits  to 
protect  plan  participants.  We  believe  that  addressing  audit  reports  to  both 
plan  administrators  and  plan  participants  wiU  increase  the  auditors’ 
awareness  about  their  role  in  protecting  plan  participants. 
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Recommendations 


We  recommend  that  the  Congress  amend  ERISA  to  eliminate  the  provision 
that  permits  plan  administrators  to  direct  audit  firms  to  perform  limited 
scope  audits. 

We  also  recommend  that  the  Congress  amend  ERISA  to  require  plan 
administrators  to  report  on  the  effectiveness  of  plan  internal  controls  and 
auditors  to  report  on  plan  administrators’  assessments  of  these  controls. 
Reports  prepared  by  plan  administrators  should  be  included  in  plan  annual 
reports  submitted  to  Labor  and  should 

describe  actions  taken  to  establish  and  maintain  an  effective  system  of 
internal  control, 

contain  the  plan  administrator’s  assessment  of  the  effectiveness  of  the 
plan’s  internal  control  structure, 

identify  material  control  weaknesses  that  have  not  been  corrected,  and 
contain  the  signature  of  the  plan  administrator. 

We  further  recommend  that  the  Congress  amend  ERISA  to  require  that  plan 
auditors 

report  fraud  and  serious  ERISA  violations  to  Labor  promptly  after  discovery 
if  plan  administrators  do  not  do  so, 

participate  in  a  peer  review  program  which  assesses  the  quality  of  at  least 
one  plan  audit,  and 

address  their  reports  jointly  to  plan  administrators  and  participants. 


Both  the  Secretary  of  Labor  and  the  Chairman  of  the  Board  of  the 
American  Institute  of  Certified  Public  Accountants  commented  on  a  draft 
of  this  report.  Their  comments  are  included  in  their  entirety  in  appendixes 
II  and  III  of  this  report. 

Labor  agreed  with  many  of  our  recommendations  but  expressed  concerns 
with  the  recommendations  on  internal  control  reporting  and  direct 
reporting. 

The  AICPA  stated  that  it  is  considering  many  of  our  recommendations.  It 
also  stated  that  it  supports  cost  beneficial  efforts  and  suggestions  to 
increase  the  protection  of  plan  participants  but  is  concerned  about  creating 
unrealistic  expectations  about  the  role  and  work  of  independent 
accountants.  We  believe  that  implementing  our  recommendations  would 
allow  the  profession  to  better  meet  the  public’s  existing  expectations. 


Agency  Comments  and 
Our  Response 
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Comments  From  the 
Department  of  Labor 


In  commenting  on  a  draft  of  this  report,  Labor  agreed  with  our 
recommendation  to  eliminate  the  limited  scope  exemption  for  plan  audits 
and  said  that  Labor  has  a  legislative  package  currently  under  consideration 
by  the  administration.  The  package  would  repeal  this  provision  of  EKISA. 
Labor  stated  its  opinion  that,  under  current  law,  it  does  not  have  authority 
to  implement  our  recommendations  on  internal  controls,  direct  reporting 
by  auditors,  and  peer  review.  We  continue  to  believe  that  Labor  hsis  the 
necessary  authority  to  implement  our  recommendations  but  in  view  of 
Labor’s  response,  we  have  modified  our  report  to  recommend  that  the 
Congress  amend  ERISA  to  require  these  improvements. 

Labor  agreed  that  significant  internal  control  weaknesses  can  lead  to  fraud 
and  abuse  of  plan  assets.  However,  Labor  expressed  concern  that  a 
separate  report  on  internal  controls  would  be  costly  and  may  inundate 
Labor  with  thousands  of  reports  which  do  not  contain  information  on 
significant  internal  control  weaknesses.  Labor  also  stated  that  it  is 
assessing  alternative  approaches  for  identifying  and  reporting  significant 
internal  control  weaknesses. 

We  continue  to  believe  that  plan  administrators’  and  auditors’  reports  on 
internal  controls  would  be  useful  to  plan  participants  and  would  emphasize 
plan  administrators’  responsibility  for  safeguarding  plan  assets  and 
complying  with  laws  and  regulations.  We  believe  a  requirement  for  ERISA 
plans  like  that  recently  legislated  for  federally  insured  financial  institutions 
would  provide  needed  assurance  to  plan  participants  that  the  plan  is 
maintaining  an  effective  control  system.  Also,  audit  standards  currently 
provide  guidance  on  how  to  determine  and  report  material  internal  control 
weaknesses. 

Labor  disagreed  with  our  recommendation  that  auditors  be  required  to 
report  fraud  and  serious  erisa  violations  directly  to  Labor.  Labor 
suggested  that  such  a  requirement  may  result  in  accountants  making 
determinations  outside  of  their  area  of  expertise.  We  continue  to  believe 
that  direct  reporting  is  feasible  and  that  auditors  have  the  expertise  to 
assess  such  violations.  We  believe  that  direct  reporting  would  provide 
Labor  with  useful  information  for  targeting  its  investigative  efforts. 
Auditing  standards  currently  provide  guidance  to  auditors  for  considering 
potential  illegal  acts,  including  seeking  the  advice  of  legal  coimsel.  Further, 
auditors  are  now  required  to  make  similar  judgments  about  compUance 
with  laws  and  regulations  when  auditing  federal  agencies  and  federal 
assistance  provided  to  state  and  local  governments  and  nonprofit 
organizations. 
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Labor  also  stated  that  it  is  considering  whether  plan  administrators  should 
be  required  to  report  to  the  Secretary  of  Labor  information  on  certain 
criminal  acts.  Labor  was  also  concerned  that  the  wider  range  of  direct 
reporting  that  we  recommended  would  require  shifting  resources  from 
reviews  of  plan  filings  and  investigative  casework.  We  believe  that 
realigning  Labor  resources  from  routine  review  of  plan  filings  to  reported 
cases  of  serious  violations  would  better  target  Labor’s  limited  resources. 

Labor  agreed  with  requiring  plan  auditors  to  undergo  peer  review  and 
pointed  out  that  such  a  requirement  is  being  considered  ais  part  of  its 
current  legislative  package. 

Labor  also  agreed  with  our  recommendation  to  address  audit  reports 
jointly  to  plan  administrators  and  participants,  and  said  it  plans  to  explore 
implementation  of  the  recommendation  through  changes  to  its  regulatory 
requirements. 


Cornments  F*rorn  the  AICPA  The  aicpa  agreed  with  our  recommendation  to  eliminate  the  limited  scope 

provision  of  ERISA.  The  aicpa  pointed  out  that  it  has  supported  this  position 
since  1978,  stating  that  plan  participants  cannot  be  provided  the  full 
assurance  contemplated  by  ERISA  if  the  independent  accountants’  audit 
excludes  certain  assets  as  currently  permitted  by  the  limited  scope 
provision. 

The  AICPA  did  not  take  a  position  on  our  recommendation  on  internal 
control  reporting.  Rather,  it  set  forth  a  number  of  issues  that  it  believes 
Labor  should  consider  in  deciding  whether  to  require  plan  administrators 
to  report  on  the  effectiveness  of  internal  controls.  The  AICPA  further  stated 
that  if  Labor  determines  that  the  benefits  outweigh  the  costs,  explicit 
auditor  reporting  on  the  plan  administrator’s  assessment  of  plan  internal 
controls  is  essential.  The  AICPA  stated  that  the  work  should  be  limited  to 
internal  controls  over  financial  reporting  and  should  be  in  accordance  with 
the  AICPA’s  Standards  of  Attestation  Engagements. 

The  AICPA  expressed  serious  concerns  with  direct  reporting  of  fraud  and 
serious  ERISA  violations  to  Labor  because  it  believes  that  disclosure  of 
matters  other  than  those  affecting  the  auditor’s  opinion  on  the  plan’s 
financial  statements  to  those  outside  the  client  organization  are  generally 
precluded  by  the  auditor’s  ethical  and  legal  obligation  of  client 
confidentiality.  We  disagree  with  this  view  of  the  auditor’s  obligation  when 
the  plan  administrator  fails  to  report  fraud  and  serious  ERISA  violations.  In 
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Expectations  of  Auditors 


this  regard,  we  note  that  the  U.S.  Supreme  Court  has  observed  that  federal 
courts  do  not  recognize  a  confidential  accountant-client  privilege  under 
which  accountants  may  withhold  information  from  federal  regulators.  We 
also  note  that  the  recently  passed  Federal  Deposit  Insurance  Corporation 
Improvement  Act  of  1991  (Public  Law  102-242)  requires  auditors  to 
disclose  certain  illegal  acts  in  reports  provided  to  regulators  of  insured 
depository  institutions. 

The  AICPA  agreed  with  our  recommendation  to  require  peer  review, 
provided  that  its  own  current  peer  review  programs  are  accepted.  We 
agree  that  Labor  should  consider  current  aicpa  peer  review  programs  as  a 
practical  means  of  implementing  a  peer  review  requirement.  These 
programs  meet  the  peer  review  requirements  of  government  auditing 
standards. 

The  AICPA  did  not  object  to  our  recommendation  that  audit  reports  be 
jointly  addressed  to  plan  administrators  and  participants  provided  that  plan 
auditors  are  not  responsible  for  distributing  copies  of  their  reports  to  plan 
participants. 


The  AICPA  also  cautioned  against  creating  an  inappropriate  expectation  that 
an  audit  of  the  financial  statements  by  the  independent  pubhc  accountant  is 
the  primary  way  to  protect  plan  participants. 

Beginning  in  early  1985,  the  AICPA  initiated  a  number  of  projects  that 
addressed  growing  public  concerns  about  the  quality  of  financial  reporting 
and  independent  audits.  After  about  3  years  of  effort,  the  AICPA  issued  10 
auditing  standards  intended  to  help  close  the  gap  between  pubhc 
expectations  of  the  auditor’s  responsibility  and  the  auditor’s  assessment  of 
that  responsibility.  In  part,  the  new  auditing  standards  expanded  the 
auditor’s  role  in  such  areas  as  understanding  internal  control  structures  as 
weU  £is  detecting  and  reporting  illegal  acts.  We  believe  that  our 
recommendations  for  expanding  plan  audit  and  reporting  requirements  are 
consistent  with  the  AlCPA’s  initiatives  to  enhance  the  effectiveness  of 
independent  audits  and  the  usefulness  of  audit  reports.  Implementation  of 
these  recommendations  would  also  aUow  the  profession  to  better  meet  the 
pubhc’s  expectations. 

While  audits  should  not  be  assumed  to  guarantee  protection,  they  can  help 
regulators  protect  plan  participants’  interests.  In  addition,  audits  can  help 
plan  administrators  fulfill  their  fiduciary  duties  and  comply  in  ah  material 
respects  with  laws  and  regulations  materially  affecting  the  financial 
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statements.  We  believe  that  the  current  audit  provisions  for  employee 
benefit  plans  do  not  go  far  enough  in  providing  protection  to  participants 
in  the  plans  and  that  implementing  our  recommendations  would  strengthen 
audits  of  plans  and  reporting  by  plan  administrators. 

The  AICPA  also  raised  the  issue  of  auditor  liability  as  it  relates  to  increased 
expectations  and  new  responsibilities,  such  as  reporting  on  internal 
controls.  We  believe  that  the  issue  of  auditor  liability  must  be  considered  in 
the  broader  context  of  all  professional  services  provided  in  this  and  other 
industries  and  should  not  bar  immediate  strengthening  of  plan  audits. 
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This  appendix  describes  the  requirements  for  audits  of  employee  benefit 
plans.  These  requirements  are  delineated  by  (1)  ERISA,  (2)  implementing 
Labor  regulations,  (3)  AICPA  guidance,  and  (4)  the  Financial  Accounting 
Standards  Board  (fasb)  Statement  No.  35  on  accounting  principles. 

ERISA  requires  plan  administrators  to  provide  Labor  with  annual  reports 
and  make  these  annual  reports  available  to  plan  participants.  While  ERISA 
generally  specifies  how  plan  administrators  are  to  satisfy  the  reporting 
requirement,  it  also  authorizes  the  Secretary  of  Labor  to  prescribe 
simplified  and  alternative  methods  of  compliance  as  the  Secretary 
determines  appropriate.  By  regulation,  the  Secretary  has  prescribed  such 
methods  which  plans  may  elect  to  use.  As  a  result,  specific  audit 
requirements  will  vary  according  to  which  annual  report  requirements  plan 
administrators  follow. 

The  requirements  outlined  in  ERISA  and  the  alternatives  contained  in  Labor 
regulations  are  similar.  For  example,  consistent  with  ERISA,  Labor 
regulations  require  that  plans  having  1 00  or  more  participants  obtain  an 
annual  audit,  which  must  be  performed  in  accordance  with  generally 
accepted  auditing  standards.  These  standards  are  promulgated  by  the 
AICPA,  which  also  issues  an  audit  guide  to  assist  auditors  in  performing  plan 
audits.  In  addition,  ERISA  and  Labor  regulations  both  require  the  auditor  to 
opine  on  the  financial  statements’  consistency  with  the  accounting 
principles  the  plan  purports  to  follow. 

However,  differences  also  exist  between  the  ERISA  and  Labor  regulation 
requirements.  For  example,  ERISA  requires  plans  to  prepare  financial 
statements  in  conformity  with  generally  accepted  accounting  principles. 
Under  Labor  regulations,  plans  may  present  financial  statements  on  bases 
other  than  generally  accepted  accounting  principles  so  long  as  any 
variances  from  those  principles  are  explained.  Also,  generally  accepted 
accounting  principles  vary  by  type  of  plan.  FASB  promulgates  these 
principles  for  defined  benefit  pension  plans,  while  the  AICPA  audit  guide 
describes  and  recommends  specialized  accounting  and  reporting  principles 
for  other  types  of  plans. 
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Annual  Report 

Contents 

The  annual  reports  required  by  ERISA  and  Labor  regulations  are  generally 
intended  to  disclose  information  about  plan  operations  and  are  a  key 
control  in  safeguarding  the  interests  of  plan  participants  and  the 
government.  As  described  below,  a  plan’s  annual  report  generally  includes 
a  Form  5500,  financial  statements,  certain  schedules,  and  an  audit  report. 
In  addition,  federally  insured  defined  benefit  pension  plans  must  file  PBGC 
Form  1 . 

Form  5500 

ERISA  and  Labor  regulations  require  that  plan  annual  reports  include  a 

Form  5500.*  The  Form  5500  contains  general  information  on  a  plan’s 
sponsor,  funding  arrangements,  participants,  and  financial  operations. 

Plan  administrators  must  file  a  Form  5500  within  7  months  of  the  close  of 
the  plan’s  fiscal  year. 

Plan  Financial  Statements 

ERISA  and  Labor  regulations  generally  require  that  plan  annual  reports 
include  two  financial  statements:  a  balance  sheet  and  an  income  statement. 
These  statements  comprise  the  core  of  financial  information  on  a  plan’s 
operations.  In  addition,  generally  accepted  accounting  principles  specify 
requirements  for  the  form,  arrangement,  and  content  of  the  financial 
statements  and  their  notes.  ERISA  and  Labor  regulations  also  require  that 
notes  to  the  financial  statements  include  a  description  of  the  plan; 
priorities  for  distributing  plan  assets  on  plan  termination;  contingent 
liabilities,  material  lease  commitments,  and  other  commitments; 
transactions  with  parties  in  interest;^  tax  status  information;®  and  any  other 
material  necessary  to  fully  and  fairly  present  plan  financial  statements. 

Some  ERISA  provisions  and  Labor  regulations  for  alternative  reporting 
differ  regarding  plan  financial  statements.  For  health  and  welfare  plans, 
ERISA  requires  a  statement  of  changes  in  financial  position  in  addition  to  a 
balance  sheet  and  an  income  statement.  Labor  regulations  require  that  the 
balance  sheet  be  presented  in  a  form  that  allows  amounts  to  be  compared 
with  those  of  the  preceding  year  at  current  value.  Labor  regulations  also 
require  two  additional  notes  not  required  imder  ERISA.  One  of  these  notes  is 

^In  addition,  certain  types  of  plans  are  required  to  include  special  attachments  to  the  Form  5500.  For 
example,  defined  benefit  pension  plan  annual  reports  require  an  actuarial  statement. 

^ERISA  prohibits  transactions  involving  conflicts  of  interest  or  dealings  among  parties  in  interest,  such 
as  plan  fiduciaries,  plan  employees,  or  plan  service  providers. 

trust  established  under  an  employee  benefit  plan  is  ordinarily  exempt  from  federal  income  taxes 
under  the  Internal  Revenue  Code. 
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to  explain  the  basis  of  accounting  used  to  prepare  the  plan’s  financial 
statements  and  describe  any  variances  from  generally  accepted  accounting 
principles.  A  second  note  is  to  explain  any  differences  between  the 
information  contained  in  the  plan  financial  statements  and  the  financial 
information  reported  on  the  Form  5500.  Labor  regulations  also  require  a 
note  on  plan  funding  policy.  ERISA  requires  such  a  note  for  pension  plans 
but  not  for  health  and  welfare  plans. 

PBGC  Form  1 

The  Form  1  (including  Schedule  A  to  the  Form  1)  and  Form  1-ES  are  forms 
used  to  report  premiums  due  to  PBGC  as  required  by  sections  4006  and 
4007  of  ERISA,  as  amended,  and  PBGC’s  Payment  of  Premiums  regulations 
(29  C.F.R.  part  2610). 

Accounting  Requirements 

ERISA  and  Labor  regulations  for  alternative  reporting  differ  in  terms  of  the 
accounting  basis  they  allow  plans  to  use  in  recording  financial  activities. 
ERISA  requires  that  plan  financial  statements  be  presented  in  conformity 
with  generally  accepted  accounting  principles,  which  require  that  accrual 
accounting  be  followed.  Accrual  accounting  is  the  method  of  recognizing 
revenue  as  services  are  rendered  and  expenses  as  they  are  incurred 
independently  of  the  time  when  funds  are  received  or  expenditures  are 
made.  FASB  Statement  No.  35  established  these  principles  for  defined 
benefit  pension  plans.  The  AICPA  audit  guide  includes  descriptions  of,  and 
recommendations  on,  specialized  accounting  and  reporting  principles  for 
other  types  of  plans. 

In  contrast.  Labor  regulations  do  not  specifically  require  that  generally 
accepted  accounting  principles,  and  thus  accrual  accounting,  be  used. 
Instead,  a  plan  electing  to  follow  Labor’s  alternative  method  of  reporting 
may  present  the  financial  statements  on  a  cash  basis;  that  is,  income  and 
expenses  may  be  recorded  when  cash  is  received  and  disbursed.  Wliile 
Labor  regulations  do  not  require  accrual  accounting,  they  do  require  plan 
financial  statements  to  (1)  include  a  note  which  explains  the  basis  of 
accounting  used  to  prepare  the  statements  and  (2)  describe  any  variances 
from  generally  accepted  accounting  principles.  Further,  auditing  standards 
require  that  the  audit  report  discuss  the  basis  of  accounting  for  financial 
statements  not  prepared  in  conformity  with  generally  accepted  accounting 
principles. 
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ERISA  Schedules 

ERISA  and  Labor  regulations  require  that  plan  annual  reports  include 
certain  schedules,  referred  to  as  erisa  schedules,  to  the  extent  that  they 
apply  to  a  plan’s  operations. 

Table  LI  shows  the  schedules  that  are  required. 

Table  1.1:  Supplemental  Schedules 
Required  by  ERISA  and  Labor 
Regulations 

Schedule 

ERISA 

(statutory 

method) 

Labor 

regulations 

(regulatory 

method) 

Assets  held  for  Investment  purposes 

X 

X 

Party-in-interest  transactions 

X 

X 

Loans  or  fixed  income  obligations  in  default  or 
classified  during  the  year  as  uncollectible 

X 

X 

Leases  in  default  or  classified  during  the  year  as 
uncollectible 

X 

X 

Reportable  transactions^ 

X 

X 

All  assets  acquired  and  disposed  of  during  the  plan 
year 

X 

Assets  and  liabilities  at  current  value  aggregated  by 
categories  and  in  comparative  form 

X 

Receipts  and  disbursements  aggregated  by  general 
sources  and  applications 

X 

"reportable  transaction”  is  a  transaction  which  involves  (1)  more  than  3  percent  of  the  current  value  of 
the  plan’s  assets  or  (2)  a  series  of  transactions  aggregating  3  percent  or  more  of  the  current  value  of  the 
plan’s  assets.  For  plan  years  beginning  on  or  after  January  1 , 1988,  this  3-percent  criterion  was  changed 
to  5  percent  for  plans  filing  under  Labor  regulations. 


Labor  regulations  exempt  certain  types  of  plan  assets  from  the  ERISA 
schedules  of  assets  held  for  investment,  assets  acquired  and  disposed  of, 
and  in  some  instances,  reportable  transactions.  Exempted  assets  and 
transactions  include 

•  bank  certificates  of  deposit  with  a  maturity  of  less  than  1  year, 

•  units  of  participation  in  a  bank  common  or  collective  trust  or  an  insurance 
company  pooled  separate  account, 

•  securities  purchased  from  a  broker-dealer  and  listed  on  a  national 
securities  exchange, 

•  debt  obUgations  of  the  United  States  or  any  agency  of  the  United  States, 

•  interests  issued  by  a  company  registered  under  the  Investment  Company 
Act  of  1940,  and 

•  investments  reported  in  other  ERISA  schedules. 
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AiiHitin<J  T?pniiirpmpnt<i  Consistent  with  erisa,  Labor  regulations  require  that  annual  reports  for 

®  plans  having  100  or  more  participants  include  an  audit  report  prepared  by 

a  qualified  independent  public  accountant.  ERISA  requires  that  the  audit 
report  include  an  opinion  as  to  whether  or  not  the  financial  statements  are 
fairly  presented  in  conformity  with  generally  accepted  accounting 
principles  on  a  basis  consistent  with  that  of  the  preceding  period.  Labor 
regulations  also  require  an  opinion  on  the  fairness  of  the  financial 
statements,  but,  since  statements  need  not  be  prepared  in  accordance  with 
generally  accepted  accounting  principles,  auditors  are  required  to  opine  on 
the  statements  and  the  basis  on  which  they  are  prepared.  In  addition,  ERISA 
and  Labor  regulations  require  that  the  audit  report  include  an  opinion  on 
the  fairness  of  ERISA  schedules  in  relation  to  the  plan’s  financial  statements 
as  a  whole. 


Auditing  Standards  erisa  and  Labor  regulations  require  that  plan  audits  be  performed  in 

accordance  with  generally  accepted  auditing  standards,  which  are 
promulgated  by  the  AlCPA.  These  standards  cover  auditor  training  and 
proficiency,  independence,  due  professional  care,  planning  and 
supervision,  evaluating  internal  controls,  obtaining  sufficient  evidence, 
reporting  on  the  financial  statements’  compliance  with  generally  accepted 
accounting  principles,  reporting  on  the  consistent  application  of 
accounting  principles,  reporting  adequate  informative  disclosures,  and 
expressing  or  disclaiming  an  opinion  on  the  financial  statements  taken  as  a 
whole. 

The  AlCPA  also  publishes  an  industry  audit  guide  to  assist  auditors  in 
performing  and  reporting  on  audits  of  plan  financial  statements.  The  guide 
includes  recommended  auditing  procedures  and  information  on  ERISA  and 
related  Labor  regulations.  Although  auditors  are  not  required  by  either 
ERISA  or  Labor  regulations  to  follow  the  AlCPA  audit  guide’s  suggested 
procedures,  AlCPA  members  may  have  to  justify  departures  from  the 
guide’s  recommendations. 

Audits  conducted  during  the  period  we  examined  were  subject  to  the 
guidance  provided  by  the  1983  edition  of  the  AlCPA  Audit  and  Accounting 
Guide  for  Employee  Benefit  Plans,  which  discussed  the  following  topics  in 
detail: 

•  planning  the  examination; 

•  study  and  evaluation  of  internal  accounting  controls; 

•  investments; 
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Provision  for  Limited  Scope 
Audits 


contributions  received  and  related  receivables; 
benefit  payments; 

participants’  data  and  plan  obligations;  and 

other  auditing  considerations  (for  example,  contingencies,  tax  status,  and 
administrative  expenses). 


ERISA  and  Labor  regulations  allow  certain  plan  assets  to  be  excluded  from 
an  auditor’s  scope  of  examination.  Specifically,  plan  administrators  may 
exclude  any  assets  held  and  transactions  executed  by  institutions,  such  as 
banks  and  insurance  carriers,  that  are  regulated,  supervised,  or  subject  to 
periodic  examination  by  a  state  or  federal  agency.  For  such  limited  scope 
audits,  the  auditor  is  to  obtain  a  certification  from  the  financial  institution 
or  insurance  carrier  as  to  the  completeness  and  accuracy  of  the 
information  and  may  disclaim  an  opinion  in  the  audit  report. 
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U.S.  DEPARTMENT  OF  LABOR 

SECRETTARY  OF  LABOR 
WASHINGTON.  D  C. 

DLC  1  2  1991 


Mr.  Donald  H.  Chapin 
Assistant  Comptroller  General 
U.  S.  General  Accounting  Office 
Washington,  D.C.  20548 

Dear  Mr.  Chapin: 

We  have  reviewed  the  draft  report  prepared  by  the  General 
Accounting  Office  (GAO)  regarding  reporting  and  audit  issues 
related  to  employee  benefit  plans.  The  GAO  draft  report  focusses 
primarily  on  a  follow-up  to  the  1989  audit  report  prepared  by  the 
Department  of  Labor's  (the  Department)  Office  of  the  Inspector 
General  and  some  of  the  more  recent  actions  taken  by  the  American 
Institute  of  Certified  Public  Accountants  (AICPA) ;  however,  it 
does  not  relate  the  activities  undertaken  concurrently  by  the 
Department's  Pension  and  Welfare  Benefits  Administration  (PWBA) , 
since  no  exit  conference  was  held  at  which  we  could  have 
described  our  efforts  in  this  area.  The  Department  has  also 
devoted  much  time  to  examining  these  issues  over  the  past  several 
years  and  designing  programs  to  address  them  and  we  believe  that 
we  have  made  a  great  deal  of  progress  in  this  area.  Therefore, 
in  addition  to  offering  comments  on  the  recommendations  proposed 
by  GAO  (see  Enclosure  I),  we  would  like  to  use  this  opportunity 
to  provide  an  update  on  the  audit-related  initiatives  which  the 
Department  has  undertaken  (see  Enclosure  II) .  Also,  we  have 
annotated  a  few  technical  corrections  in  the  enclosed  pages  from 
the  draft  report  (see  Enclosure  III) , 

It  is  important  to  explain  at  the  outset  that  we  have 
concluded,  in  conjunction  with  the  Solicitor  of  Labor,  that  we  do 
not  have  statutory  authority  to  implement  substantive  changes  in 
the  scope  of  the  audit  to  be  performed  by  the  auditor  engaged  by 
the  plan ,  the  form  in  which  the  auditor  reports ,  or  the 
educational  requirements  for  accountants.  In  fact,  section 
103(a)(3)(A)  of  the  Employee  Income  Security  Act  of  1974  (ERISA) 
specifically  defers  to  the  use  of  Generally  Accepted  Auditing 
Standards  (GAAS)  and  Generally  Accepted  Accounting  Principles 
(GAAP)  in  the  preparation  and  audit  of  plan  financial  statements. 
Accordingly,  we  have  considered  the  draft  report's  recommenda¬ 
tions  primarily  in  the  context  of  possible  legislation. 

Finally,  since  several  of  GAO's  recommendations  relate 
directly  to  decisions  which  can  be  made  only  by  the  American 
Institute  of  Certified  Public  Accountants  (AICPA) ,  we  assume  that 
a  copy  of  this  draft  report  has  been  shared  with  them. 
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See  page  29. 
See  page  29. 


See  page  29. 


Enclosure  I 


DEPARTHENT  OF  LABOR  (DOL)  RESPONSE  TO  THE  RECOMMENDATIONS 
CONTAINED  IN  THE  GAO  DRAFT  REPORT  ENTITLED 
"IMPROVED  PLAN  REPORTING  AND  CPA  AUDITING 
INCREASE  PROTECTION  UNDER  ERISA" 


GAO  Recommendation  No.  1;  DOL  [should]  reconsider  the  nine 
audits  and  refer  the  auditor  to  professional  and/or  licensing 
authorities  if  deemed  appropriate,  (pg.  36) 

DOL  Response:  The  audits  identified  by  GAO  are  now  five  to  six 
years  old.  The  AICPA's  Professional  Ethics  Division  has  a 
significant  backlog  of  referrals  from  the  Department  of  Labor *s 
Pension  and  Welfare  Benefits  Administration  (PWBA)  that  still 
need  to  be  resolved.  Accordingly,  as  an  alternative  approach, 
PWBA  will  review  the  more  recent  Form  5500  filings  and  the  audit 
reports  prepared  by  the  accounting  firms  in  question  to  determine 
if  professional  accounting  and  auditing  deficiencies  still  exist. 
If  so,  these  more  recent  audits  can  be  referred  to  the  AICPA's 
Professional  Ethics  Division  for  further  investigation. 


GAO  Recommendation  No.  2:  The  AICPA  [should]  change  its  audit 
guide  to 

—  discuss  the  importance  of  audits  in  protecting  plan 
participants ; 

—  discuss  the  need  for  auditors  to  have  specialized 
industry  knowledge  needed  to  successfully  perform  plan 
audits ; 

—  identify  and  clearly  describe  requirements  for  specific 
schedules  and  financial  statement  footnotes.  These 
requirements  should  include  those  for  statements  prepared 
under  the  statutory  and  regulatory  methods,  as  well  as  GAAP 
requirements.  (pgs.  43-44) 

DOL  Response!  We  believe  that  this  basic  information  currently 
is  incorporated  in  the  revised  AICPA  audit  and  accounting  guide. 
In  both  the  Preface  and  Chapter  1,  reference  is  made  to 
specialized  information  and  knowledge  that  the  auditor  needs 
relating  to  employee  benefit  plans.  We  also  note  that 
Appendix  A,  page  117,  paragraphs  A. 41  and  A. 42  provide  detailed 
information  on  the  financial  statements,  footnotes,  and 
supplemental  schedules  required  under  both  the  statutory  and 
regulatory  methods  of  filing. 
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See  page  40. 
See  page  40. 
See  page  40. 
See  page  40. 


GAO  Recommendation  No,  3;  The  AICPA  [should]  communicate  to  its 
membership  the  results  of  (1)  its  investigations  of  the  10  audits 
referred  by  Labor,  with  which  the  AICPA  found  problems,  and  (2) 
the  results  of  future  investigations  of  deficient  plan  audits, 
(pg.  44) 

POL  Response;  We  agree  and  would  like  to  note  that  we,  too,  have 
urged  the  AICPA  to  publicize  the  results  of  its  investigations  of 
employee  benefit  plan  audits  referred  by  PWBA. 


GAO  RecQiBmQndation  No.  4t  Congress  [should]  amend  ERISA  to 
eliminate  the  provision  that  permits  plan  administrators  to 
direct  audit  firms  to  perform  limited-scope  audits.  (pg.  59) 

POL  Response;  The  Department  of  Labor  is  on  record  as  being  in 
favor  of  eliminating  the  limited-scope  audit  exemption  provided 
under  29  CFR  2520.103-8.  In  its  1990  ERISA  legislative  proposal, 
the  Department  recommended  the  repeal  of  the  limited-scope 
exemption  for  plan  audits,  encouraging  instead,  the  use  of  the 
"single  audit"  approach  that  is  currently  available  under 
Generally  Accepted  Auditing  Standards  (GAAS) -  The  Department’s 
current  legislative  package  is  now  in  the  final  stages  of 
consideration  by  the  Administration.  The  issue  of  repeal  of  the 
limited-scope  audit  exemption  is  among  those  being  considered. 

pecommendation  No.  5:  The  Department  of  Labor  [should] 
promulgate  regulations  to  require  plan  administrators  to  report 
on  the  effectiveness  of  plan  internal  controls  and  auditors  to 
report  on  plan  administrators*  assessment  of  these  controls. 
Reports  prepared  by  plan  administrators  should  be  included  in 
plan  annual  reports  submitted  to  Labor  and  should 

—  describe  actions  taken  to  establish  and  maintain  an 
effective  system  of  internal  controls. 

—  contain  the  plan  administrator’s  assessment  of  the 
effectiveness  of  the  plan's  internal  control  structure, 

—  identify  material  control  weaknesses  that  have  not  been 
corrected,  and 

—  contain  the  signature  of  the  plan  administrator. 

(pg.  59) 

POL  Response;  While  PWBA  agrees  that  significant  internal 
control  weaknesses  can  lead  to  fraud  and  abuse  of  plan  assets, 
the  approach  recommended  in  GAO's  draft  report  may  well  result  in 
the  reporting  of  internal  control  weaknesses  that  are  not 
significant.  Requiring  a  separate  report  on  internal  controls 
will  be  costly  to  plans  and  plan  sponsors,  and  may  inundate  PWBA 
with  thousands  of  reports  which  do  not  contain  significant 
internal  control  weaknesses.  Furthermore,  both  the  revised  AICPA 
audit  guide  and  Generally  Accepted  Auditing  Standards  provide  for 
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the  review  of  and  reporting  on  internal  controls.  Significant 
internal  control  weaknesses  may  be  reported  in  the  context  of  the 
audit  report  or  disclosed  in  notes  to  the  financial  statement. 

PWBA  is  currently  assessing  alternative  approaches  for  the 
identification  and  reporting  of  significant  internal  control 
weaknesses.  One  alternative  would  require  plan  administrators  to 
indicate  on  the  plants  annual  report  filing  (Form  5500)  when 
significant  internal  control  weaknesses  have  been  identified. 

This  information  could  then  be  identified,  and  followed-up  on,  in 
conjunction  with  PWBA*s  automated  targeting  efforts.  An 
advantage  of  this  approach  is  that  it  can  be  accomplished  without 
statutory  amendment. 

Finally,  the  Department  also  notes  that  it  does  not  have  the 
authority  under  current  law  to  adopt  this  recommendation  without 
statutory  changes  to  the  extent  that  it  requires  a  change  in  the 
scope  of  the  existing  audit . 


Recommendation  No.  6;  The  Department  of  Labor  [should]  require 
that  plan  auditors 

—  report  fraud  and  serious  ERISA  violations  promptly  after 
discovery  if  plan  administrators  do  not  do  so, 

—  participate  in  a  peer  review  program  which  assesses  the 
quality  of  at  least  one  plan  audit,  and 

—  address  their  report  jointly  to  plan  administrators  and 
participants.  (pg.  60) 

POL  Response;  With  respect  to  direct  reporting,  the  Department 
is  considering  whether  plan  administrators  should  be  required  to 
report  to  the  Secretary  of  Labor  information  related  to  certain 
criminal  acts  involving  employee  benefit  plans  covered  by  ERISA. 
The  draft  GAO  report  does  not  define  its  term  "serious 
violations"  and  without  further  explanation,  there  is  a  concern 
that  accountants  may  be  asked  to  make  determinations  outside  of 
their  area  of  expertise,  e.g. ,  legal  decisions  involving  other 
provisions  of  the  statute.  Also,  the  Department  has  reservations 
about  implementing  a  wider  range  of  direct  reporting  outside  of 
the  framework  of  the  Form  5500  annual  report  and  PWBA*s  new 
automated  ERISA  Information  System.  Resources  used  to  administer 
a  program  of  direct  notification  of  a  variety  of  alleged 
violations  would  have  to  be  diverted  from  the  review  of  plan 
filings  and  investigative  casework  currently  being  performed.  We 
do  not  see  a  benefit  commensurate  with  such  a  shift  in  resources. 

The  Department  has  supported  a  requirement  that  accountants 
conducting  ERISA  audits  obtain  a  peer  review  every  three  years  to 
remain  qualified  to  perform  such  audits.  A  similar  provision  was 
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in  the  legislation  introduced  into  the  101st  Congress  in  November 
1990.  It  is  also  being  considered  along  with  other  pension 
issues  as  part  of  the  Department's  current  legislative  package 
now  in  the  final  stages  of  consideration  by  the  Administration. 

In  regard  to  these  first  two  components  of  this  recommendation, 
the  Department  notes  that  under  current  law,  it  does  not  have  the 
authority  to  adopt  such  recommendations  without  statutory 
changes . 

The  Department  agrees  with  the  recommendation  that  audit  reports 
be  addressed  to  plan  participants.  Under  the  revised  AICPA 
industry  audit  guide  and  Generally  Accepted  Auditing  Standards, 
plan  auditors  are  permitted  to  address  audit  reports  to  both  plan 
administrators  and  plan  participants.  The  Department  will 
explore  whether  this  change  could  be  accomplished  through  the 
regulatory  process  if  the  instructions  for  the  Form  5500  were 
amended  to  require  that  the  report  be  addressed  to  the  plan 
administrator  on  behalf  of  the  participants  and  beneficiaries. 

We  note  that  the  impact  of  this  recommendation  to  remind 
accountants  for  whom  the  audit  is  being  performed  is  more 
symbolic  than  substantive. 


Recommendation  No.  7:  If  the  Department  of  Labor  does  not 
promulgate  regulations  to  implement  these  recommendations,  ...the 
Congress  [should]  amend  ERISA  to  achieve  these  objectives. 

(pg.  60) 

POL  Response;  As  noted  above  in  our  responses  to  specific 
recommendations,  the  Department  is  already  in  the  process  of 
addressing  many  of  these  concerns. 
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Enclosure  II 


DEPARTMENT  OF  LABOR  INITIATIVES 
RELATED  TO  REPORTING  AND  ACCOUNTING  ISSUES 


To  better  deal  with  the  issues  raised  by  the  OIG  and  to  enhance 
the  accounting  and  auditing  expertise  within  the  agency,  PWBA 
established  an  Office  of  the  Chief  Accountant  (OCA)  in  1988  to 
provide  a  centralized  unit  which  would  focus  on  accounting  and 
auditing  related  issues,  including  the  quality  control  issues 
discussed  in  the  OIG*s  1987  study  on  ERISA  plan  audits.  OCA*s 
first  efforts  were  directed  in  two  main  areas:  (1)  developing  an 
internal  quality  control  program  relating  to  the  review  of  Form 
5500  annual  reports  and  their  accountant*s  opinions  and  (2) 
establishing  an  on-going  relationship  with  the  professional 
accounting  organizations,  such  as  the  AICPA  and  the  Financial 
Accounting  Standards  Board,  to  improve  employee  benefit  plan 
audit  procedures  and  practices.  Of  particular  note  during 
FY  1989  was  the  development  and  implementation  of  the  procedures 
for  referral  to  the  AICPA  and  state  Boards  of  Accountancy  of 
substandard  audits  of  employee  benefit  plans  for  investigation 
and  action. 

During  this  same  time  frame,  PWBA  implemented  two  major  program 
initiatives  which  have  a  direct  bearing  on  plan  audits:  a  new 
computer  database  system  to  enhance  the  Agency's  ability  to 
effectively  target  employee  benefit  plans  with  the  highest 
potential  for  ERISA  violations  and  a  reporting  compliance  program 
under  ERISA  Section  502(c)(2)  to  review,  reject  if  inadequate, 
and  assess  civil  penalties  with  respect  to  the  plans'  annual 
filings  including  their  accountant's  reports. 

The  ERISA  Information  System  serves  as  the  central  source  of 
information  on  the  financial  status  and  activities  of  the  pension 
plans  within  PWBA's  jurisdiction  and  on  welfare  plans  with  more 
than  100  participants.  Through  this  system  (which  utilizes  the 
information  from  the  Form  5500  series  of  reports  which  are 
required  to  be  filed  annually  by  plan  administrators) ,  PWBA  is 
able  to  subject  financial  data  and  information  on  plan  activities 
to  a  comprehensive  automated  analysis  to  determine  whether  there 
are  any  indications  of  violations  within  30  days  of  receipt  by 
the  Internal  Revenue  Service  of  the  filing.  The  initial 
screening  of  all  Form  5500  reports  is  accomplished  through  a 
system  of  over  130  computerized  edit  checks.  As  a  result  of 
these  automated  edit  tests,  over  318,000  plan  administrators 
received  notices  from  the  Federal  government  that  there  were 
errors  or  missing  items  in  their  Form  5500s  for  the  1988  plan 
year.  Approximately  309,000  such  notices  were  sent  to  plan 
administrators  for  the  annual  reports  covering  the  1989  plan 
year. 
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In  addition,  PWBA  uses  the  results  of  the  edit  checks  as  the 
foundation  of  a  reporting  compliance  program  under  which  the 
Agency  may  reject  an  annual  filing  if  the  Form  5500,  or  its 
accompanying  accountant's  opinion,  is  considered  to  be 
inadequate.  Under  a  recent  amendment  to  section  502  of  ERISA, 
PWBA  is  now  able  to  assess  civil  penalties  of  up  to  $1,000  per 
day  against  plan  administrators  for  missing,  late  or  deficient 
reporting  under  the  statute. 

During  FY  1990,  PWBA's  accounting,  enforcement,  policy  and 
regulatory  offices  explored  legislative  initiatives  to  resolve 
those  recommendations  made  by  the  OIG  regarding  plan  audits  which 
required  legislative  amendments  to  ERISA.  During  this  period,  a 
task  force  appointed  by  Secretary  of  Labor  Elizabeth  Dole  was 
conducting  a  review  of  all  Departmental  enforcement  strategies. 
After  that  study  was  completed  in  September  1990,  the  Department 
also  concluded  that  changes  to  ERISA  were  needed  to  implement 
these  enforcement  initiatives,  including  repeal  of  the  limited 
scope  audit  provisions  of  the  statute  and  the  implementation  of 
peer  review  requirements.  As  a  result  of  these  efforts,  ERISA 
enforcement  legislation  was  introduced  in  November  1990,  although 
the  101st  Congress  adjourned  without  taking  action  on  the 
legislation. 

In  FY  1991,  PWBA's  Office  of  the  Chief  Accountant  (OCA)  made 
significant  progress  in  a  number  of  key  operational  areas  related 
to  the  recommendations  of  the  GAO  draft  report: 

(1)  OCA  worked  extensively  with  the  American  Institute  of 
Certified  Public  Accountants  (AICPA)  in  the  revision  of  the 
AICPA's  guide  for  the  audit  of  employee  benefit  plans  which 
was  issued  in  March  1991; 

(2)  OCA  participated  with  the  AICPA  in  planning  and 
presenting  an  Annual  Employee  Benefit  Plans  Update 
Conference;  produced  audit  risk  alerts  and  checklists  for 
accounting  practitioners  and  continuing  professional 
education  materials  for  accountants  and  other  professionals 
who  perform  services  for  employee  benefit  plans;  and  has 
urged  the  AICPA  to  develop  other  opportunities  for 
professional  training  in  the  ERISA  area  (a  new  self-study 
course  will  be  available  in  mid-November  1991  and,  in  May 
1992,  the  AICPA  will  present  a  lecture  series  in  a  number  of 
major  cities  to  provide  training  on  the  revised  industry 
guide)  ; 

(3)  OCA  conducted  in-house  reviews  of  1200  accountant's 
reports  submitted  with  ERISA  annual  reports  for  compliance 
with  professional  standards; 

(4)  OCA  initiated  a  program  of  on-site  reviews  of 
Independent  Public  Accountant  audit  work  papers  and,  in 
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FY  1991,  conducted  26  such  reviews  based  on  the  results  of 
the  above  mentioned  in-house  review  of  accountant's  opinions 
and  referrals  from  PWBA  field  offices  of  substandard  work 
identified  during  investigations  of  employee  benefit  plans; 

(5)  OCA  made  extensive  use  of  new  enforcement  authority 
under  ERISA  Section  502(c)(2)  against  plan  administrators  who 
failed  to  obtain  correction  of  deficient  audit  work.  In  FY 
1991,  OCA  issued  692  letters  rejecting  ERISA  report  filings 
and  imposed  penalties  of  $5.9  million  against  plan 
administrators  who  did  not  demonstrate  a  reasonable  cause  for 
failing  to  obtain  adequate  audits.  In  many  instances,  the 
plan  administrators  are  seeking  repayment  from  the  plan 
auditor;  and 

(6)  By  the  end  of  FY  1991,  OCA  made  a  cumulative  total  of  105 
referrals  to  the  AICPA's  Professional  Ethics  Division  and  10 
referrals  to  state  Boards  of  Accountancy.  Of  the  37  cases 
closed  to  date,  the  AICPA  recommended  Trial  Board  action  for 
11  cases  and  required  corrective  actions  and  continuing 
professional  education  in  17  cases.  In  some  instances,  AICPA 
members  have  been  required  to  submit  additional  work  products 
for  review  after  their  training  requirements  have  been 
fulfilled.  The  AICPA  has  reported  that  in  the  period  from 
May  1986  through  August  1991,  PWBA  referred  twice  as  many 
cases  as  any  other  government  agency,  and  that . the  AICPA  may 
expand  its  Professional  Ethics  Committee  to  have  a 
subordinate  unit  dealing  specifically  with  ERISA  referrals. 

In  September  1991,  the  Department's  Policy  Review  Board 
considered  a  refined  overall  ERISA  legislative  package,  which 
also  included  other  enforcement  issues,  as  part  of  the 
Department's  legislative  program  for  FY  1992.  ERISA  issues,  such 
as  the  repeal  of  the  limited-scope  audit  exemption  and  peer 
review  requirements,  are  again  part  of  the  Department's 
legislative  proposal  for  FY  1992.  The  Department  expects  that 
this  legislative  proposal  dealing  with  ERISA  accounting  issues 
will  be  introduced  into  the  102nd  Congress  in  early  1992.  In 
addition,  PWBA  continues  to  work  on  an  on-going  basis  with  the 
AICPA  in  areas  such  as  (i)  the  continuing  professional  education 
for  members  of  the  accounting  profession  who  conduct  employee 
benefit  plan  audits  and  (2)  the  application  of  sanctions  against 
those  practitioners  who  perform  substandard  audit  work. 

In  summary,  in  the  intervening  years  since  the  OIG's  first  study 
regarding  employe  benefit  plan  audits,  we  believe  that  aggressive 
enforcement  in  the  accounting  area  and  on-going  liaison  with  the 
accounting  profession  has  raised  the  consciousness  of  benefit 
plan  auditors  and  has  encouraged  compliance  with  the  requirements 
of  ERISA.  PWBA's  reporting  compliance  and  quality  control 
programs  have  heightened  awareness  of  the  reporting  and  auditing 
requirements  contained  in  ERISA.  These  programs  have  increased 
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the  visibility  of  the  Department's  efforts  to  ensure  accurate 
reporting  of  plan  activities  and  that  plan  audits  meet 
professional  accounting  and  auditing  standards.  The  rejection  of 
plan  filings,  imposition  of  Section  502(c)(2)  civil  penalties, 
and  referral  of  deficient  professional  work  by  accountants  to 
licensing  authorities  are  indicative  of  the  Department's 
commitment  to  strong  enforcement  of  ERISA's  reporting 
requirements . 


Page  61 


GAO/AFMD-92-14  ERISA 


Appendix  III 


Comments  From  the  American  Institute  of 
Certified  Public  Accountants 


AlCPA 


American  institute  of  Certified  Public  Accountants 

■M55  Pennsylvania  Avenue.  N  W. 
Washington.  DC  20004-1007 
(202)  737-6600 
Telecopier  1202)  638-4512 


December  17,  1991 


Mr.  Donald  H.  Chapin 
Assistant  Comptroller  General 
Accounting  and  Financial  Management 
U.S.  General  Accounting  Office 
441  G  Street,  N.W. 

Washington,  DC  20548 

Dear  Mr.  Chapin: 

The  American  Institute  of  Certified  Public  Accountants  (AICPA) 
appreciates  the  opportunity  to  comment  on  the  GAO's  October  1991 
Draft  Report,  "Employee  Benefits:  Improved  Plan  Reporting  and  CPA 
Audits  Can  Increase  Protection  Under  ERISA"  (Draft  Report) .  This 
letter  sets  forth  our  general  comments  on  the  Draft  Report;  the 
attachment  includes  our  comments  on  GAO's  specific  recommendations. 

The  AICPA  is  the  national  professional  association  of  certified 
public  accountants  (CPAs)  representing  more  than  300,000  CPAs  in 
public  practice,  industry,  government,  and  education.  Over  the 
years,  the  AICPA  has  been  a  principal  force  in  the  development  of 
professional  standards,  guidance,  and  educational  programs  designed 
to  improve  the  quality  of  services  provided  by  CPAs.  Throughout 
its  more  than  100  years  of  service  to  its  members  and  the  public, 
the  AICPA  has  become  widely  recognized  as  the  authoritative  voice 
of  the  profession  in  the  United  States. 

AICPA  Supports  Efforts  to  Assure  That  Plan  Participants  Receive 
Their  Benefits 


On  June  13,  1990,  representatives  of  the  AICPA  testified  before  the 
Subcommittee  on  Oversight  of  the  Committee  on  Ways  and  Means,  U.S. 
House  of  Representatives,  on  the  subject  of  enforcement  and  admin¬ 
istration  of  the  Employee  Retirement  Income  Security  Act  of  1974 
(ERISA) . 

In  our  statement,  we  said: 

We  gather  here  today  in  a  noble  cause.  Secretary  of 
Labor  Elizabeth  Dole  captured  its  essence  in  a  recent 
speech.  Referring  to  pension  security,  she  said: 

We  will  strive  to  ensure  that  every  partici¬ 
pant  receives  the  benefits  to  which  he  or  she 
is  entitled . 
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Her  pledge,  I  am  sure,  would  be  seconded  by  every  one  of 
us ,  and ,  most  certainly ,  by  the  members  of  the  AICPA . 

Her  goal  is  important  to  the  vigor  of  both  our  economic 
and  democratic  systems. 

In  that  same  speech.  Secretary  Dole  said: 

We  have  been  working  closely  with  the  American 
Institute  of  Certified  Public  Accountants  on 
all  audit  related  issues,  including  compliance 
testing. . .  I  am  pleased  to  report  that  our 
negotiations  with  the  AICPA  on  this  matter  are 
progressing  constructively. 

We  want  to  reiterate  our  strong  commitment  to  helping  the  Depart¬ 
ment  of  Labor  (DOL)  and  the  Internal  Revenue  Sep^ice  (IRS)  in 
assuring  that  every  participant  receives  the  benefits  to  which  he 
or  she  is  entitled. 

We  also  stated  (in  our  June  13,  1990  testimony)  that  the  DOL  and 
IRS  rules,  in  theory,  do  protect  the  interests  of  the  American 
worker-  Vigorous  enforcement  of  those  rules  is  the  key  to  turning 
that  theory  into  reality.  We  recommended  that  Congress  be 
receptive  to  requests  from  the  IRS  and  DOL  to  enhance  their 
capability  to  insightfully  review  returns  and  reports,  and  to 
quickly  send  out  well  trained  examiners  in  appropriate  circum¬ 
stances  . 

Independent  Accountant's  Responsibility  Under  Generally  Accepted 
Auditing  Standards  (GAAS) 

The  independent  accountant's  objective  and  responsibility,  under 
GAAS,  is  to  express  an  opinion  on  whether  the  financial  statements 
of  an  entity  are  fairly  presented  in  accordance  with  generally 
accepted  accounting  principles  and  are  free  from  material  misstate¬ 
ments,  whether  caused  by  fraud  or  error.  In  so  doing,  the 
independent  accountant  gives  reasonable  assurance  to  the  users  of 
those  statements  that  the  financial  information  including  total 
assets  and  liabilities  reported  by  the  entity  is  credible. 

An  audit  of  financial  statements  conducted  in  accordance  with  GAAS 
is  not  the  only  means  of  assuring  compliance  with  the  reporting 
provisions  of  ERISA.  Under  the  law,  plan  administrators,  the  IRS, 
and  the  DOL  have  the  responsibility  to  assure  compliance  with 
ERISA's  provisions.  The  annual  report  and  the  financial  statements 
prepared  by  the  plan  administrator  and  the  independent  accountant's 
report  contributes  to  the  monitoring  activities  of  these  parties 
and  agencies.  An  audit  is  an  important  discipline  on  the  financial 
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information  reported  by  the  plan  administrator  of  the  covered 
plans,  but  it  is  not  designed  to  assure  compliance  with  all 
legislative  and  regulatory  requirements  that  relate  to  employee 
benefit  plans. 

The  AICPA  supports  cost  beneficial  efforts  and  suggestions  to 
increase  the  protection  of  plan  participants.  However,  we  caution 
against  creating  an  inappropriate  expectation  that  an  audit  of  the 
financial  statements  by  the  independent  accountant  is  the  primary 
protection . 

With  respect  to  the  public's  understanding  of  the  role  of  the 
independent  accountant  in  the  reporting  process  under  ERISA,  we  are 
concerned  that  the  title  of  the  GAO's  Draft  Report,  as  well  as  and 
some  of  the  statements  made  therein,  may  create  an  unrealistic 
expectation  in  the  mind  of  members  of  Congress,  government 
officials,  plan  participants,  and  others  relative  to  the  role  and 
work  of  independent  accountants  when  they  are  engaged  to  audit  a 
plan's  financial  statement  in  accordance  with  GAAS . 

If  the  Congress  and  the  DOL  wish  the  independent  accountant  to 
expand  the  scope  of  work  beyond  an  audit  of  the  financial  state¬ 
ments  of  a  covered  plan  to  include  a  report  on  compliance  with 
specified  laws  and  regulations,  they  must  be  explicit  in  what  it 
requires.  The  laws  and  regulations  and  the  criteria  against  which 
the  independent  accountant  would  be  required  to  test  and  report 
must  be  clearly  defined  and  specified .  For  example , 

♦  they  must  relate  to  financial  matters  within  the  competence  of 
independent  accountants ; 

♦  they  must  establish  requirements  with  sufficient  precision  to 
permit  obj ective  evaluation  of  plan  compl iance ;  and 

♦  there  must  be  reasonable  criteria  to  measure  compliance. 

Of  course,  before  they  set  out  on  this  path,  the  Congress  and  the 
DOL  must  also  recognize  that  any  additional  work  required  for  the 
plans  may  entail  significant  costs.  However,  if  they  believe  that 
this  increased  scope  is  desirable  and  beneficial,  we  will  work  with 
the  DOL  to  develop  the  necessary  agreed-upon  procedures  that  the 
independent  accountant  would  apply  in  testing  such  compliance  and 
issuing  the  appropriate  report  in  accordance  with  applicable 
attestation  standards  issued  by  the  AICPA. 
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AICPA  Efforts  to  Assist  Its  Members 

Auditing  standards  and  procedures,  audit  quality  controls,  and 
individual  auditor  performance  are  essential  elements  in  achieving 
the  objective  of  an  audit  conducted  in  accordance  with  GAAS.  To 
assist  its  members  in  achieving  that  objective,  the  AICPA  has 
established  a  number  of  inter-related  programs  to  strengthen  stand¬ 
ards  of  auditor  performance.  In  this  respect — 

♦  the  AICPA  has  adopted  and  continuously  augments  auditing 
standards  and  other  types  of  auditor  guidance; 

♦  the  AICPA  has  adopted  quality  control  standards  that  are 
required  to  be  followed  by  all  members  who  perform  audits; 

♦  for  more  than  ten  years,  the  AICPA^s  Division  for  CPA  Firms 
has  monitored  compliance  by  its  members  with  quality  control 
and  auditing  standards  through  a  comprehensive  program  of  peer 
reviews; 

♦  more  recently,  the  AICPA  has  adopted  a  program  of  mandatory 
quality  reviews  for  all  members  in  public  practice  who  provide 
audit  and  accounting  services;  and 

♦  the  AICPA  administers  programs  as  part  of  an  overall  system — 
which  includes  state  boards  of  accountancy,  state  CPA  socie¬ 
ties,  and  the  courts — to  deal  with  allegations  of  individual 
misconduct. 

The  Draft  Report  summarizes  the  specific  steps  taken  by  the  AICPA 
to  address  the  findings  of  the  DOL's  Inspector  General  (IG) 
relative  to  his  review  and  findings  of  plan  audits  under  ERISA. 

Unreasonable  Expectations  May  Lead  to  Increased  Unwarranted 
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against  the  defendant  with  the  deepest  pockets.  We  seek  your 
support  in  urging  the  Congress  to  adopt  a  proportionate  liability 
standard — one  that  holds  a  defendant  responsible  for  the  conse¬ 
quences  of  his  or  her  actions,  and  not  the  harm  caused  by  others. 
We  are  seeking  fairness,  not  special  treatment.  Such  fairness  is 
especially  crucial  when  the  services  provided  by  independent 
accountants  are  expanding  to — as  recommended  by  GAO — meet  newly- 
identified  needs,  such  as  reporting  on  internal  control  and  testing 
for  compliance  with  laws  and  regulations. 

The  GAO'S  Findings  of  Some  Non-Adherence  to  Auditing  Standards 

In  the  Draft  Report,  the  GAO  cites  instances  of  non-adherence  to 
auditing  standards  in  the  audits  it  reviewed.  The  AICPA  takes  most 
seriously  any  allegation  of  poor  audit  quality.  In  December  of 
1987,  when  the  DOL's  IG  issued  his  report  and  identified  certain 
deficiencies,  we  arranged  a  meeting  shortly  after  issuance  of  that 
report  with  representatives  of  the  DOL  to  discuss  the  report  and 
determine  what,  if  anything,  the  AICPA  could  do  to  address  those 
matters  discussed  in  the  report.  Following  that  meeting,  a  new 
AICPA  committee  was  established  to  improve  and  expedite  guidance  in 
this  area  and  to  work  with  the  DOL  to  address  appropriate  matters 
of  mutual  interest  and  to  deal  with  mutual  problems . 

The  Draft  Report  summarizes  the  many  steps  the  AICPA  has  taken — and 
continues  to  take — to  improve  the  quality  of  audits  of  plan 
financial  statements.  The  steps  we  have  taken  are  designed  to 
improve  the  quality  of  work  in  the  future.  If  the  DOL  believes 
some  benefit  will  be  derived  from  referring  additional  audits,  we 
would  welcome  them. 

Conclusion 

Audit  deficiencies,  if  and  when  they  occur,  do  not  necessarily 
correlate  with  plan  mismanagement  or  beneficiary  risk.  For 
example,  assets  available  for  benefits  are  not  adversely  affected 
by  the  lack  of  a  footnote  disclosure  in  the  administrator's  report 
or  nonperformance  of  an  audit  procedure  by  the  independent 
accountant . 

The  ’*at  risk"  status  of  plan  beneficiaries  is  overwhelmingly 
influenced  by  factors  beyond  the  scope  of  audits  of  financial 
statements  or  the  ability  of  independent  accountants  to  influence. 
The  most  prominent  of  these  factors  is  the  quality  of  investment 
judgements  by  plan  administrators  or  investment  fiduciaries. 
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December  17,  1991 
Page  6 


The  AICPA  will  continue  to  work  with  the  DOL  to  address  areas  of 
mutual  interest.  The  AICPA  takes  any  allegations  concerning  poor 
performance  by  independent  accountants  extremely  seriously. 
Nevertheless,  we  are  confident  that  the  public  may  rely  on  the 
independent  accountants'  reports  to  provide  the  assurance  plan 
participants  deserve  regarding  the  financial  status  of  the  plan. 

The  attachment  includes  our  comments  on  the  specific  recommenda¬ 
tions. 
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ATTACHKENT  TO  AICPA'S  DECEMBER  17,  1991  LETTER  ON 
GAO'S  OCTOBER  1991  DRAFT  REPORT, 

••EMPLOYEE  BENEFITS:  IMPROVED  PLAN  REPORTING  AND 
CPA  AUDITS  CAN  INCREASE  PROTECTION  UNDER  ERISA** 


Chapter  2 


See  page  24. 


GAO  Recommendation 

DOL  should  reconsider  the  nine  audits  and  refer  the 
auditor  to  professional  and/or  licensing  authorities  if 
deemed  appropriate. 

AICPA  Comment 

As  stated  in  our  letter,  the  AICPA  takes  seriously  any  allegations 
concerning  poor  performance  by  auditors.  If  the  DOL  determines 
that  benefits  greater  than  the  related  costs  will  be  derived  by 
referring  the  additional  nine  audits,  the  AICPA  Ethics  Division 
will  review  and  investigate  the  allegations  and  report  its  findings 
to  the  DOL. 


Chapter  3 


See  page  29. 


GAO  Recommendation 

Audit  guide  [AICPA  Audit  and  Accounting  Guide,  ‘‘Audits  of 
Employee  Benefit  Plans**]  should  be  changed  to  discuss  the 
importance  of  audits  in  protecting  plan  participants. 

AICPA  Comment 

The  audit  requirement  included  in  ERISA  is  an  important  part  of  the 
total  process  designed  to  protect  plan  participants.  The  audit  of 
the  financial  statement  provides  reasonable  assurance  to  the  users 
of  the  plan's  financial  statements — including  plan  participants — 
that  the  financial  information  including  total  assets  and  liabili¬ 
ties  reported  by  the  plan  administrator  is  relevant  and  credible. 
Accordingly,  we  will  expand  the  discussion  in  the  audit  guide  to 
emphasize  that  the  DOL  and  plan  administrators,  on  behalf  of  plan 
participants,  rely  on  the  audit  to  provide  the  assurances  noted 
above . 
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See  page  29. 


See  page  29. 


GAO  Recommendation 

Audit  guide  [AICPA  Audit  and  Accounting  Guide,  ''Audits  of 
Employee  Benefit  Plans"]  should  discuss  the  need  for 
auditors  to  have  specialized  industry  knowledge  to 
successfully  perform  plan  audits. 

AICPA  Comment 

Generally  accepted  auditing  standards  require  auditors  to  obtain 
specialized  industry  knowledge  when  conducting  an  audit  of  the 
financial  statements.  Specifically,  Statement  on  Auditing  Stand¬ 
ards  (SAS)  No.  22,  "Planning  and  Supervision,”  provides  such 
guidance.  The  planning  chapter  of  the  audit  guide  refers  the 
reader  to  SAS  No.  22.  We  believe  that  audit  guides  need  not 
restate  all  of  the  SASs.  Nevertheless,  we  will  consider  expanding 
the  discussion  to  address  this  recommendation. 


GAO  Recommendation 

Audit  guide  [AICPA  Audit  and  Accounting  Guide,  "Audits  of 
Employee  Benefit  Plans"]  should  identify  and  clearly 
describe  requirements  for  specific  schedules  and  finan¬ 
cial  statement  footnotes.  These  requirements  should 
include  those  for  statements  prepared  under  the  statutory 
and  regulatory  methods,  as  well  as  GAAP  requirements. 

AICPA  Comment 

We  agree  that  Table  I.l  in  the  Appendix  of  the  Draft  Report, 
"Supplemental  Schedules  Required  by  ERISA  and  Labor  Regulations,” 
may  be  helpful  to  auditors,  and  we  will  consider  including  it  in 
the  audit  guide  to  supplement  the  existing  guidance  contained  in 
Exhibit  A-4 ,  which  discusses  the  general  audit  and  filing  require¬ 
ments.  Representatives  of  the  DOL  have  informed  us  that  no  plan 
administrator  currently  files  reports  using  the  statutory  method 
permitted  by  ERISA. 


GAO  Recommendation 

The  AICPA  should  communicate  to  its  membership  the 
results  of  current  and  future  investigations. 

AICPA  Comment 

The  nature  and  extent  of  the  findings  based  on  our  ethics  investi¬ 
gations  was  discussed  at  the  AICPA  Employee  Benefit  Plans  Confer¬ 
ence  on  December  12-13,  1991.  They  will  also  be  covered  in  a 

future  article  in  the  Journal  of  Accountancy.  The  findings  are  not 
significantly  different  from  the  IG's  findings  that  have  been 
widely  publicized.  Nevertheless,  we  will  consider  publishing  the 
results  of  future  investigations  by  the  AICPA  Ethics  Division. 
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Chapter  4 


GAO  Recommendation 

See  page  40.  congress  should  amend  ERISA  to  eliminate  the  provision 

that  permits  plan  administrators  to  direct  audit  firms  to 
perform  limited  scope  audits. 

AICPA  Comment 

We  support  the  recommendation  that  the  Congress  amend  ERISA  to 
eliminate  the  limited  scope  audit  exemption.  The  constraint  on  the 
utility  of  audits  results  wholly  from  current  regulations  and 
practices  of  plan  administrators. 

The  AICPA  is  on  record,  beginning  in  1978,  as  stating  that  plan 
participants  cannot  be  provided  the  full  assurance  contemplated  by 
ERISA  if  the  independent  accountant's  audit  is  restricted  to 
exclude  assets  held  in  a  bank  or  similar  institution  or  an  insur- 
ance  carrier  as  permitted  by  Section  103(a) (3) (C) .  If  the  Congress 
wishes  to  remove  this  constraint  on  the  utility  of  reguired  audits, 
it  need  only  eliminate  the  authority  to  impose  limitations  on  the 
scope  of  audit. 


GAO  Recommendation 

See  page  40.  DOL  should  promulgate  regulations  to  require  plan  admin¬ 

istrators  to  report  on  the  effectiveness  of  plan  internal 
controls  and  auditors  to  report  on  plan  administrators' 
assessment  of  these  controls. 

AICPA  Comment 

In  deciding  whether  to  require  plan  administrators  to  report  on  the 
effectiveness  of  internal  controls  and  require  auditors'  associa¬ 
tion  therewith,  the  DOL  should,  among  other  things,  thoroughly 
consider: 

♦  the  cost  of  complying  and  benefits  to  be  derived; 

♦  the  size  and  organizational  structure  of  plans; 

♦  the  definition  and  scope  of  the  meaning  of  "internal  control 
structure";  and 

♦  the  extent  that  plan  internal  control  structures  exist  under 
the  direct  control  of  plan  administrators,  or  exist  at  third- 
party  service  organizations,  custodians,  or  other  external 
entities  used  by  plan  administrators  to  perform  various 
aspects  of  plan  operations. 
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If  the  DOL  determines  that  the  benefits  of  reporting  on  the 
effectiveness  of  the  internal  control  structure  outweigh  the  costs, 
we  believe  that  explicit  auditor  reporting  on  the  plan  adminis¬ 
trator's  assessment  of  plan  internal  control  structure,  accompanied 
by  a  level  of  work  to  support  that  reporting,  is  essential - 
Further,  the  auditor's  work  and  reports  on  internal  control  should 
be  limited  to  internal  controls  over  financial  reporting  and  should 
be  in  accordance  with  the  Standards  for  Attestation  Engagements. 


GAO  Recommendation 

DOL  should  require  plan  auditors  to  report  fraud  and 
serious  ERISA  violations  promptly  after  discovery  if  plan 
administrators  do  not  do  so. 

AICPA  Comment 

The  AICPA  agrees  that  the  plan  administrator  has  the  primary 
responsibility  to  report  matters  to  plan  participants  and  the  DOL. 
The  auditor's  vehicle  for  reporting  outside  the  plan  is  the 
auditor's  report  on  the  financial  statement.  With  respect  to  fraud 
and  serious  ERISA  violations,  auditors,  in  accordance  with  GAAS, 
currently  have  an  affirmative  responsibility  to  expand  their  pro¬ 
cedures  when  they  become  aware  of  information  indicating  that  an 
illegal  act  has  or  may  have  occurred.  These  responsibilities 
include  determining  whether  it  is  likely  that  an  illegal  act  has 
occurred  and,  if  so,  the  possible  effect  on  the  financial  state¬ 
ments.  These  responsibilities  also  include  making  inquiries  of 
plan  management  above  those  involved,  if  possible. 

If  the  illegality  is  not  inconsequential  and  the  plan  administrator 
does  not  take  appropriate  action  (which  may  include  required 
notification  to  the  DOL) ,  an  appropriate  course  of  action  to  be 
taken  by  the  auditor  may  be  to  resign. 

The  AICPA  has  serious  concerns  with  direct  reporting  by  independent 
auditors  of  noted  ERISA  violations  to  the  DOL  because  disclosures 
of  matters  other  than  those  that  affect  the  auditor's  opinion  on 
the  plan's  financial  statements  to  those  outside  the  client 
organization  are  generally  precluded  by  the  auditor's  ethical  and 
legal  obligation  of  client  confidentiality.  If  the  plan  adminis¬ 
trator  must  report  to  the  DOL  ERISA  violations  and  does  not,  the 
auditor  would  ordinarily  lose  confidence  in  management's  integrity 
and  would  normally  resign  from  the  engagement.  The  Securities  and 
Exchange  Commission  (SEC)  currently  requires  the  filing  of  a  Form 
8-K  for  a  change  in  auditor  which  includes  reasons  for  the  change. 
The  DOL  may  wish  to  consider  requiring  the  filing  of  a  similar  form 
whenever  a  plan  changes  its  auditor. 
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GAO  Recommendation 

Auditors  should  participate  in  a  peer  review  program 
which  assesses  the  quality  of  at  least  one  plan  audit. 

AICPA  Comment 

There  are  three  AICPA  practice-monitoring  programs.  Two  have 
existed  since  1977:  the  peer  review  programs  of  the  SEC  Practice 
Section  (SECPS)  and  of  the  Private  Companies  Practice  Section 
(PCPS)  of  the  AICPA  Division  for  CPA  Firms.  The  third,  the  quality 
review  program  carried  out  in  a  partnership  with  state  CPA 
societies,  was  organized  in  1988  based  on  the  success  of  those  two 
peer  review  programs.  A  firm  whose  partners  and  employees  wish  to 
remain  members  of  the  AICPA  must  participate  in  one  of  those  three 
programs.  (The  SECPS  peer  review  program  was  made  mandatory  in 
January  1990  for  all  firms  that  audit  one  or  more  SEC  clients,  as 
defined . ) 

More  than  6,600  firms  are  members  of  the  SECPS,  the  PCPS,  or  both 
Sections.  They  represent  approximately  half  of  the  roughly  150,000 
AICPA  members  in  public  practice.  The  other  half  practice  in  about 
39,000  practice  units.  Over  16,000  of  these  units  have  audit 
clients.  Although  the  AICPA  does  not  yet  have  hard  data,  we 
believe  that  the  large  majority  of  audits  of  U.S.  companies,  public 
and  private,  are  carried  out  by  firms  that  are  members  of  the  SECPS 
or  the  PCPS. 

Recognizing  the  public  interest  in  audits  of  employee  benefit  plans 
conducted  pursuant  to  ERISA,  each  practice-monitoring  program  has 
adopted  requirements  designed  to  provide  added  assurance  about  the 
quality  of  ERISA  audits.  Both  the  SECPS  and  the  PCPS  have  adopted 
requirements  mandating  the  selection  of  at  least  one  ERISA  audit 
for  review  in  every  SECPS  or  PCPS  peer  review. 

The  Quality  Review  Program's  Executive  Committee  has  taken  a 
somewhat  different  approach  and  has  adopted  an  interpretation  of 
the  program's  Standards  that  concludes  as  follows: 

Regulatory  and  legislative  developments  during  1990  have 
made  it  clear  that  there  is  a  significant  public  interest 
in  audits  conducted  pursuant  to  the  Employee  Retirement 
Income  Security  Act  of  1974.  Accordingly,  greater  weight 
should  be  given  in  the  engagement  selection  process  on 
on-site  reviews  to  those  audits  if  the  firm  performs  such 
engagements . 

The  Quality  Review  Program's  Executive  Committee  took  this  slightly 
different  approach  because  of  the  importance,  cost,  and  difficulty 
of  carrying  out  reviews  of  thousands  of  firms  every  three  years. 
The  Committee  fears  that  various  government  agencies  could  mandate 
review  of  audits  of  entities  that  come  under  their  surveillance. 
This  would  increase  the  cost  of  carrying  out  reviews  substantially 
and,  as  a  result,  might  jeopardize  support  within  the  profession 
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for  this  unprecedented  program.  The  Committee  believes  that  a 
review  of  a  firm's  practice  on  a  sampling  basis  should  provide 
adequate  assurance  that  persons  who  perform  ERISA  audits  are 
adequately  trained  and  supervised  to  conduct  such  audits  in 
conformity  with  applicable  requirements. 

We  make  these  observations  for  your  consideration  because,  although 
we  support  mandatory  quality  reviews  of  all  public  accounting  firms 
that  audit  employee  benefit  plans,  we  would  not  be  able  to  support 
regulation  that  would  supplant  the  standards,  procedures,  and 
guidelines  that  we  have  developed  as  a  result  of  extensive  and 
expensive  experience.  Our  programs  are  working.  We  believe  the 
DOL  can  rely  on  those  programs  and  on  the  standards  and  procedures 
that  govern  them.  Additionally,  specific  regulation  would  only 
make  it  more  difficult  to  carry  out  an  effective,  self -regulatory 
practice-monitoring  program. 

We  recommend  that  the  GAO  suggest  that  the  DOL  accept  the  Insti¬ 
tute's  programs  and  discourage  the  issuance  of  new,  costly  and 
unnecessary  regulations . 


GAO  Recommendation 

Auditors  should  address  their  reports  jointly  to  plan 
administrators  and  participants. 

AICPA  Comment 

The  AICPA  would  not  object  to  the  DOL  requiring  auditors  to  address 
jointly  their  reports  to  plan  administrators  and  participants  and 
beneficiaries,  so  long  as  it  is  made  explicit  in  any  such  require¬ 
ment  that  auditors  would  not  have  a  responsibility  to  distribute 
copies  of  their  reports  to  all  participants  and  beneficiaries, 
which  would  be  impractical  and  costly.  It  should  be  noted  that 
plan  administrators  currently  are  not  required  to  send  copies  of 
audited  plan  financial  statements  to  all  plan  participants  and 
beneficiaries;  however,  copies  may  be  provided  to  them  by  the  plan 
administrator  upon  request. 

***** 
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